Summary Points
- 1.3 million+ Android devices were backdoored: Google attributes the XCPE botnet with high confidence to device maker Videostrong.
- The backdoor was commercialized: Criminal affiliates used infected set-top boxes and other IoT devices for ad fraud, residential proxies, and further malware.
- Google and partners disrupted the operation: They took legal action against its infrastructure, cut Videostrong off from Android certification, and estimate the action may sever access to 10 million more compromised devices.
- The risk extends beyond homes: Proxy traffic can hide attacks, while compromised business or healthcare IoT devices may expose networks. Avoid “share your internet” apps and use trusted app stores and Play Protect.
Backdoor turned everyday devices into a botnet
Google and its partners disrupted XCPE, a botnet that compromised more than 1.3 million Android-based devices. Most were TV set-top boxes, but the network also included telehealth equipment, karaoke machines and digital signs.
Google’s Threat Intelligence Group says, with high confidence, that device maker Videostrong Technology built the backdoor into several models and brands starting at least in 2024. Google says Videostrong then sold criminal affiliates access to infected devices. Those affiliates used them for ad fraud, installed more malware and routed internet traffic through people’s home connections.
That last tactic can make harmful online activity look like it comes from ordinary households. As a result, businesses may struggle to spot attacks using familiar tools such as location-based blocking. Google has not confirmed that attackers used XCPE devices to break into business or health care networks.
Partners cut off control systems
Google, Japan’s National Police Agency and technology partners took legal action to disrupt the servers and web addresses used to control XCPE and its add-on malware. Google says the move could also cut off access to at least 10 million other compromised devices linked to the affiliates’ networks.
Google has barred Videostrong and its future affiliates from making or selling certified Android devices or supplying software to certified vendors. The company says Videostrong hid malicious code until after devices first started up, which helped it evade initial checks. Google says it has strengthened its review process. Videostrong did not immediately respond to a request for comment.
Connected devices make entertainment and services easier to use. However, XCPE shows how a compromised device can also help criminals reach far beyond one home. Google advises consumers to use trusted app stores, check app permissions and keep Google Play Protect on. It also warns against apps that pay users to share unused internet access, since those apps may enlist devices in proxy networks.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
CyberRisk-V1
