Google and industry partners dismantled the XCPE backdoor last week in a Google Android botnet takedown that had enrolled more than 1.3 million set-top boxes. The move cuts off a large infected device pool and narrows the route that criminal affiliates used to push more malware through the same system.
XCPE and 1.3 million boxes
Google said the backdoor was built directly into many different device models and brands over multiple years. That means the infection was not a one-off compromise at the edge of the network. It was embedded into the supply chain that put devices in homes and businesses.
Google assessed with high confidence that Videostrong Technology Co. intentionally developed, deployed, and operated the backdoor and botnet for financial gain. The company monetized access by selling it to criminal affiliates, which turned the infected devices into a platform for ad-fraud, residential proxy enrollment, and additional malware loading.
Google and partners
Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyze the malware ecosystem and disrupt its operations. Google also took legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules.
Google took action against command and control domains tied to over a dozen malware families loaded as modules through the backdoor. It also assessed that severing those C2 domains would cut off access to at least 10 million additional compromised devices, so the takedown reaches beyond the 1.3 million set-top boxes already inside XCPE.
Videostrong and Android tests
Google said Videostrong used obfuscation techniques to exploit a gap in its tests and load malicious code after the device’s first boot. That leaves a practical lesson for buyers of Android devices with preloaded Google apps: compatibility and security tests can miss software that hides until after setup, which is why Google changed its review process and banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices.
The unanswered question is which specific device models and brands were infected over the multi-year campaign. Google has not spelled that out, and that missing list is what would let buyers and OEMs check whether a particular box was part of the build that carried XCPE.
