Google and partners disrupt the XCPE Android malware botnet by shutting down its servers and taking down the backdoor operating on Android TV set-top boxes. The operation affects more than 1.3 million devices, which were enrolled into a botnet controlled through a backdoor hidden in firmware.
Across outlets, Google’s Threat Intelligence reporting says it has high confidence the device maker behind the activity is Videostrong Technology. The reporting describes Videostrong as intentionally building and deploying the backdoor for financial gain, including selling access to criminal affiliates. The botnet activity is described as being used for ad fraud and for proxy-like functions that route other traffic through compromised devices in residential settings.
Several outlets also note enforcement actions: Google bans the company behind the devices it says were intentionally compromised. LWN emphasizes additional operational detail from Google’s Threat Intelligence post, while other outlets focus more on the scale of the disruption and the company attribution.
