cyber.hendryadrian.com
Security News · cyberscoop.com

Google Disrupts XCPE Botnet Found on More Than 1.3 Million Android Devices

· Original article ↗

Summary

Google says it disrupted the XCPE botnet, which it attributes to backdoors in Videostrong devices. The operation targeted control infrastructure and reportedly disrupted access to at least 10 million additional compromised devices.

Key points

  • Google says Videostrong devices contained backdoors that formed the XCPE botnet, used for ad fraud, data theft and malicious traffic routing.
  • The botnet included more than 1.3 million TV set-top boxes and infected other Android-based devices, including telehealth devices, karaoke machines and digital signs.
  • Google took legal action against the domains and servers used to control XCPE and also took down command-and-control domains used by more than a dozen malware families.
  • Google said the action disrupted access to at least 10 million additional compromised devices from various manufacturers.
  • Google said Videostrong's malware was loaded after devices' first boot to evade security testing; Google banned the company from building or selling certified Android devices.
  • TrendAI researchers reported XCPE devices in more than 170 countries and nearly 44,000 infected devices in the U.S. between June and October.

Article Details

Event Type
Google-led legal and technical disruption of the XCPE botnet and associated command-and-control infrastructure.
Impact
The botnet operated through backdoors in more than 1.3 million Android devices, primarily TV set-top boxes, and was used for ad fraud, data exfiltration, and routing malicious traffic through residential proxies. Google said its actions disrupted access to at least 10 million additional compromised devices and seriously impacted more than a dozen malicious actors. Infected devices were reported across more than 170 countries.

People

Charley SnyderHead of disruption operations at Google Threat Intelligence Group; he discussed the XCPE disruption and Google’s detection and review processes.

Threat Actors

Videostrong Technology Co.Google’s report says the device manufacturer purposefully implanted backdoors in devices it sold, establishing the XCPE botnet; Google said it did not believe this was an isolated rogue insider or development oversight.

Malware

XCPEThose backdoors established XCPE, an expansive botnet that cybercriminals used to conduct ad fraud, steal data and route malicious traffic through residential proxy networks, according to a Google Threat Intelligence

Vendors

GoogleGoogle and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday.Videostrong Technology Co.Videostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold.

Products

AndroidGoogle and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday.Android TVMost of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs.

Countries

BrazilThe botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.ChinaVideostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold.IraqThe botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.MalaysiaThe botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.MexicoThe botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.TaiwanThe botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers.United StatesNearly 44,000 infected devices were based in the United States between June and October.

Related Articles