Google disrupts 1.3 million-device Android botnet and bans the TV box maker behind it

Google has disrupted a sprawling Android botnet that it says ran on a backdoor deliberately built into the firmware of consumer devices, and has banned the manufacturer it holds responsible from the certified Android ecosystem. According to The Hacker News, Google took down the command-and-control infrastructure of the operation, which its blog identifies as the XCPE botnet, after tracing it to Shenzhen-based device maker Videostrong.

What happened

The Hacker News reports that Google used legal action to seize the domains and servers controlling the botnet and worked alongside partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and Trend Micro's TrendAI unit. Google also banned Videostrong, along with any future subsidiaries or affiliates, from building or selling certified Android devices and from supplying software to certified device makers.

Technical details

According to The Hacker News, the backdoor, called x.cpe, runs as a system app inside device firmware with system-level access. It connects to command-and-control servers and waits for instructions, and to install software silently it first disables the app-scanning checks in Google Play Protect. Google says operators could install apps, run commands, take screenshots, log keystrokes, copy account and device details, open reverse shells, and map local networks. Most add-on modules, the company says, turned the boxes into residential proxies or sold their bandwidth, while others faked ad views.

Who is affected

The Hacker News, citing Trend Micro's TrendAI, reports that researchers counted 1,472,554 infected devices across 206 models between June 3 and October 1, with the real figure likely higher. Google expects the takedown to cut off access to at least 10 million more infected devices because the operators spread the malware by other means as well. The devices were mostly Android TV set-top boxes, but the backdoor also appeared on telehealth devices, karaoke machines, and digital signage. The most-affected countries were Malaysia, Brazil, Iraq, Mexico, and Taiwan.

Google says it is highly confident Videostrong intentionally built the backdoor and sold access to criminals, rather than blaming a rogue insider or mistake. The Hacker News reports that supporting evidence cited by researchers includes a GitHub account named "yf-videostrong" hosting botnet packages and a document signed by a Videostrong research director found on a botnet server. The company's website still listed "Google Certified" TV boxes on November 2, the report says.

What to do

The Hacker News reports that removing x.cpe does not stick, because it reinstalls on restart; TrendAI says cleanup requires vendor action, platform-level protection, or device replacement, and Synthient advises discarding affected boxes outright. Synthient published 182 device model names tied to the campaign, though a model name alone does not confirm infection. For organizations, researchers recommend using the published indicators to find such devices on the network, disconnecting and disposing of any found, blocking the listed control domains, and segmenting consumer smart devices away from sensitive systems.