Google disrupted XCPE botnet and banned Videostrong after 1.3M infections

XCPE was preloaded in firmware and used HTTP and MQTT control

Google said Videostrong used obfuscation techniques to exploit a testing gap and load malicious code after devices completed their first boot. The company said the software had been built directly into many device models and brands over multiple years.

The secondary modules conducted ad fraud, silently enrolled devices in residential proxy networks and loaded additional malware. TrendAI said the operator scheduled proxy and ad-fraud modules onto about 1.33 million devices.

TrendAI saw proxy sales, silent installs and Play Protect changes

TrendAI reported more than 3.8 million distinct home and mobile IP addresses over four months. It said access through infected TV set-top boxes was sold as residential proxy and AI gateway services.

TrendAI observed silent install commands reaching more than 187,000 devices and saw a script that turned off Google Play Protect on a large number of devices. The company said owners cannot remove the implant themselves because it runs as a system app signed with the manufacturer’s key.

Google said it assessed with high confidence that Videostrong intentionally developed, deployed and operated the backdoor and botnet for financial gain. It said Videostrong monetized the operation by selling access to criminal affiliates and loading their malware modules onto infected devices.

Google worked with six partners to disrupt the operation

Google said it worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to analyze the malware ecosystem and disrupt its operations.

TrendAI said the botnet spanned more than 170 countries. It said the United States, Germany, the United Kingdom, Australia and Canada each had about 26,000 to 42,000 infected devices.

Plume said the botnet included both Google-certified devices and devices running the Android Open Source Project version. The Hacker News said Google’s report did not state how many certified devices were affected.

Google said it took legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules. The company also said the disruption seriously impacted more than a dozen malicious actors.

Google changed its review process and is improving firmware checks for certified Android TV devices. TrendAI said owners cannot remove the implant themselves because it runs as a system app signed with the manufacturer’s key, leaving vendor action, platform protection or device replacement as the stated cleanup options.