● Covered by 8 sources · 8 reportsMedium impact2 negative6 neutral
Google Disrupts 1.3 Million-Device Android Botnet, Bans Manufacturer Videostrong
Key points
- Google disrupted the XCPE botnet of over 1.3 million Android devices.
- Videostrong Technology Co. allegedly installed a backdoor in its devices.
- The backdoor was used for ad fraud and residential proxy services.
- Google took legal action to dismantle command-and-control servers.
- Videostrong has been banned from Google's Android ecosystem.
- XCPE botnet included Android set-top boxes and other IoT devices.
- Videostrong Technology is a China-based OEM/ODM.
- Malicious software was built into many device models and brands over multiple years.
- Google took down botnet domains and servers, plus C&C domains for additional modules.
- Takedown likely severed access to at least 10 million other devices.
- XCPE botnet infected devices in over 200 countries.
- Videostrong sold devices under the MECOOL brand.
- The malware bypassed Google's certification by being installed remotely after device setup.
- The malware disabled Play Protect.
- The botnet included telehealth devices, karaoke machines, and digital signage devices.
- Google collaborated with cybersecurity firms and Japanese law enforcement.
- Videostrong sold access to criminal affiliates to monetize the backdoor.
- The backdoor allowed remote malware installation on end-user devices.
- Google terminated its partnership with Videostrong.
Botnet Takedown and Manufacturer Ban
Google, in collaboration with partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, has disrupted the XCPE botnet. This botnet consisted of more than 1.3 million Android devices, predominantly TV set-top boxes. The operation involved taking down the command-and-control (C2) servers that managed the botnet.
Intentional Backdoor by Videostrong
Google states with high confidence that Chinese device manufacturer Videostrong Technology Co. intentionally placed a backdoor, named x.cpe, into its Android TV boxes and other devices. This backdoor was built into many device models and brands over several years. Google does not believe the backdoor was the result of a rogue insider or a mistake, but rather a deliberate action for financial gain.
Malicious Activities and Monetization
Videostrong allegedly monetized this backdoor by selling access to criminal affiliates. These affiliates used the backdoored devices for various malicious activities, including ad fraud, creating residential proxy networks, and installing additional malware. The infected devices were used without the owners' knowledge to pass internet traffic through their home connections and for data exfiltration.
Google's Response and Ecosystem Impact
As a result of these findings, Google has terminated its relationship with Videostrong and banned the company and its subsidiaries from manufacturing or selling certified Android devices, or supplying software to other certified vendors. Google also took down control domains of more than a dozen malware families loaded through the backdoor, which also cut off access to at least 10 million additional compromised devices that were infected through other means, including retail set-top boxes, karaoke machines, and telehealth hardware.
Updates
- Videostrong sold access to criminal affiliates to monetize the backdoor.
- The backdoor allowed remote malware installation on end-user devices.
- Google terminated its partnership with Videostrong.
- XCPE botnet infected devices in over 200 countries.
- Videostrong sold devices under the MECOOL brand.
- The malware bypassed Google's certification by being installed remotely after device setup.
- The malware disabled Play Protect.
- The botnet included telehealth devices, karaoke machines, and digital signage devices.
- Google collaborated with cybersecurity firms and Japanese law enforcement.
- XCPE botnet included Android set-top boxes and other IoT devices.
- Videostrong Technology is a China-based OEM/ODM.
- Malicious software was built into many device models and brands over multiple years.
- Google took down botnet domains and servers, plus C&C domains for additional modules.
- Takedown likely severed access to at least 10 million other devices.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub synthient/public-researchHow outlets covered it
Google revealed that certified Android TV partner Videostrong Technology Co. intentionally installed a backdoor in 1.3 million set-top boxes, then sold access to criminal affiliates. This allowed for ad fraud, residential proxy networks, and remote malware installation on end-user devices. Google has terminated its partnership with Videostrong and banned them from producing devices with preloaded Google apps.
Google, in collaboration with cybersecurity firms and Japanese law enforcement, dismantled the X.CPE botnet, which infected over 1.3 million Android TV set-top boxes and other IoT devices across more than 200 countries. The botnet was allegedly tied to Chinese OEM Videostrong Technology, which monetized access by selling it to criminal affiliates for various malicious activities. Google has cut ties with Videostrong and banned them from preloading Google apps on devices.
Google's Threat Intelligence Group has shut down the x.cpe botnet, which infected over 1.3 million Google-certified Android TV devices, primarily from Videostrong Technology. The malware bypassed Google's certification by being installed remotely after device setup, disabling Play Protect, and was used for residential proxies and ad fraud.
Google has dismantled the XCPE botnet, which comprised over 1.3 million Android set-top boxes and other IoT devices. The botnet was developed and operated by Videostrong Technology, an OEM/ODM that pre-installed malicious software for ad fraud, data exfiltration, and residential proxy services. Google took legal action to seize control of the botnet's infrastructure and banned Videostrong from producing devices with preloaded Google apps.
Google discovered that its Android manufacturing partner, Videostrong Technology Co., secretly installed a backdoor in 1.3 million Android-based devices, turning them into a botnet for ad fraud and data exfiltration. Google has dismantled the backdoor, banned Videostrong from its ecosystem, and updated its device review processes. This incident highlights supply chain vulnerabilities in Android IoT devices.
Google has terminated its partnership with Videostrong, an Android TV device manufacturer, after discovering the company pre-installed a malware backdoor on certified devices. Google has taken legal action to dismantle the associated botnet infrastructure and is updating its device review process to prevent similar incidents.
Google and partners disrupted the XCPE botnet, which comprised over 1.3 million Android TV boxes intentionally infected with malware by manufacturer Videostrong Technology Co. The botnet was used for ad fraud, creating residential proxies, and installing additional malware. Google terminated its relationship with Videostrong and revoked its Android TV device manufacturing license.
Google led a takedown of a botnet comprising over 1.3 million Android devices, primarily TV set-top boxes, by seizing control of its command-and-control servers. Google attributes the botnet to device maker Videostrong, which allegedly intentionally embedded a backdoor in its products and sold access to criminals for ad fraud and proxy services. Google has banned Videostrong from its Android ecosystem.