Google Disrupts 1.3 Million-Device Android Botnet, Accuses TV Box Maker of Selling Criminal Access
Summary
Google says it disrupted a botnet affecting more than 1.3 million Android devices, mostly TV boxes, and accuses maker Videostrong of intentionally installing the x.cpe backdoor and selling criminal access.
Key points
- Google used legal action to take down the botnet's control servers and domains, with assistance from law enforcement and security firms.
- TrendAI counted 1,472,554 infected devices across 206 models from June 3 to October 1; Google expects the operation to also disrupt access to at least 10 million more infected devices.
- The x.cpe backdoor runs as a system app in device firmware, can disable Google Play Protect app checks, and reinstalls itself after a restart.
- Google says operators used the backdoor to install apps, run commands, capture screens, collect keystrokes and account details, and open reverse shells.
- Most criminal modules used infected devices as residential proxies or for ad fraud. The backdoor was also found on telehealth devices, karaoke machines, and digital signage.
- Google banned Videostrong from making or selling certified Android devices and says it has improved firmware review checks.
- TrendAI says cleanup requires vendor action, platform protection, or device replacement. Plume recommends a factory reset but does not say whether it removes x.cpe.
Article Details
- Event Type
- Google-led legal takedown of command-and-control domains and servers used by an Android botnet.
- Impact
- The botnet affected more than 1.3 million Android devices, mostly TV set-top boxes. Google says the devices were used for ad fraud and residential proxy traffic, and that operators could install apps, run commands, capture screens, collect keystrokes and account details, and open reverse shells. The x.cpe backdoor remains in device firmware and reinstalls after a restart; Google expects the disruption to cut off criminals’ access to at least 10 million additional infected devices.
MITRE ATT&CK
T1056.001 · KeyloggingGoogle says operators sent keystrokes from infected devices.T1090 · ProxyModules turned infected devices into residential proxies, routing other parties’ traffic through owners’ home connections.T1113 · Screen CaptureGoogle says operators used the backdoor to capture live screenshots from infected devices.T1496 · Resource HijackingThe botnet used device resources and spare bandwidth for residential proxy services and ad fraud.
Threat Actors
Malware
Vendors
GoogleA botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google.VideostrongGoogle says it is highly confident that device maker Videostrong intentionally put a backdoor in the boxes and sold access to criminals.
Products
Android Open Source Project (AOSP)Plume says the botnet included both Google-certified devices and devices running the Android Open Source Project (AOSP) version. Google's report does not say how many certified devices were affected.Android TVVideostrong, based in Shenzhen, China, makes Android TV boxes and other devices under its own name and for other brands. The backdoor, called x.cpe, was built into many device models and brands over several years.Google Play Protectservers and waits for orders. To install software silently, it first turns off the app checks in Google Play Protect, Android's built-in security feature.MECOOL KM9PRO MaxSynthient's report focuses on MECOOL-branded boxes, which it links to Videostrong. It bought a MECOOL KM9PRO Max and found the backdoor preinstalled. Plume, which makes Wi-Fi software for internet providers, found moreYokaTV PlayerIn Google's account, x.cpe passes settings from the C2 server to other Videostrong apps, including its YokaTV Player streaming app. One of the GitHub accounts that hosted the botnet's packages is named yf-videostrong.
Countries
Australialeast that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.Brazilacross 206 models between June 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had aboutCanadahigh. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.Germanythe real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.Iraq206 models between June 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000Malaysiadevices across 206 models between June 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada eachMexicobetween June 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 toTaiwanJune 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.United Kingdomis at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.United Statessays the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.