Google Says Videostrong Built XCPE Botnet With Preinfected Android Devices
Summary
Google researchers said Videostrong preinstalled malware on Android and IoT devices, enabling the XCPE botnet to support ad fraud, proxy services and data theft. Google and partners disrupted the botnet and restricted Videostrong’s access to Google apps.
Key points
- Google researchers attributed the XCPE botnet to Chinese device manufacturer Videostrong, which they said sold criminal affiliates access to more than a million compromised devices.
- The devices were primarily Android TV set-top boxes, with other affected device types including telehealth equipment, karaoke machines and digital signage systems.
- The malware had system-level privileges, could restore itself from firmware after reboot and evolved from single-stage droppers to a modular, three-stage architecture.
- Google said the malware could turn devices into residential proxy nodes, run ad-fraud modules or install additional backdoors.
- Google said an external loader used anti-analysis techniques to evade security testing; the malware also disabled Google Play Protect after wiping user-consent settings.
- Google said it disrupted the botnet with Japan’s National Police Agency and other security organizations, and barred Videostrong from making devices with preloaded Google applications.
- Google assessed that taking down the botnet’s C2 domains would sever access to at least 10 million additional compromised devices; this was an estimate, not a confirmed count of affected devices.
Article Details
- Event Type
- Reported botnet operation and disruption involving malware-preinfected Android and IoT devices.
- Impact
- Google researchers said Videostrong supplied malware-laced devices, including Android TV set-top boxes and other IoT devices, and sold criminal affiliates access to more than a million compromised devices. Google said it disrupted the botnet with Japan's National Police Agency and other security organizations, and banned Videostrong from making devices with preloaded Google applications. Google assessed that taking down the botnet's C2 domains could sever access to at least 10 million additional compromised devices.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationGoogle said Videostrong used obfuscation techniques to evade security tests and load malicious code after the device's first boot.T1090.002 · External ProxyThe article says infected devices were turned into residential proxy exit nodes.T1105 · Ingress Tool TransferThe article says malware actors' secondary modules were loaded onto infected devices from remote hosts.T1496 · Resource HijackingThe infected devices were monetized as ad-fraud engines and residential proxy exit nodes.T1497.001 · System ChecksGoogle said the external loader used anti-analysis utilities to thwart sandbox detection.T1562.001 · Disable or Modify ToolsThe malware wiped user-consent configuration and disabled Android's built-in Google Play Protect malware protection.
Threat Actors
Malware
Moyu(e.g. CBOXTV, HiddenView), or execute additional backdoors that load even more monetization modules (e.g. Moyu, Spirit)," Google said.SpiritCBOXTV, HiddenView), or execute additional backdoors that load even more monetization modules (e.g. Moyu, Spirit)," Google said.XCPEmachines and digital signage systems. The firm's pre-implanted backdoor established a botnet known as XCPE, named after a malicious Android application.
Vendors
GoogleAn Android device manufacturer based in China supplied malware-laced devices to many brands over the years and created a botnet for ad-fraud and data exfiltration, Google researchers said Monday.Videostrong Technology Co.The company, Videostrong Technology Co., sold criminal affiliates access to more than a million compromised devices and installed their malware, primarily on Android TV set-top boxes but also on IoT devices such as
Products
AndroidAn Android device manufacturer based in China supplied malware-laced devices to many brands over the years and created a botnet for ad-fraud and data exfiltration, Google researchers said Monday.Android TVaffiliates access to more than a million compromised devices and installed their malware, primarily on Android TV set-top boxes but also on IoT devices such as telehealth equipment, karaoke machines and digitalGoogle Play ProtectThe malware also wiped user consent configuration on the device and then disabled Android's built-in malware protection tool Google Play Protect.
Countries
ChinaAn Android device manufacturer based in China supplied malware-laced devices to many brands over the years and created a botnet for ad-fraud and data exfiltration, Google researchers said Monday.JapanGoogle said it has disrupted the botnet with Japan's National Police Agency and other security organizations and banned Videostrong from making devices with preloaded Google applications.