Google Says It Dismantled XCPE Botnet Affecting 1.3 Million Android Devices

Summary

Google says it disrupted the XCPE botnet, which affected more than 1.3 million Android devices, and took legal action against its domains and servers. Google attributes the operation to Videostrong, which allegedly used devices for ad fraud, data exfiltration and proxy,

Key points

Google announced the disruption of XCPE, a backdoor and botnet affecting more than 1.3 million Android devices, mostly TV set-top boxes.
Google attributes the operation to device maker Videostrong, which it says developed the malware, operated the botnet and sold affiliates access.
Google says infected devices were used for ad fraud, data exfiltration, residential proxy services and loading additional malware.
Google took legal action to take down botnet domains and servers, and command-and-control domains for additional modules.
Google says the action likely severed access to at least 10 million other devices reached by malware distribution beyond XCPE.
Google says Videostrong used obfuscation to load malicious code after devices' first boot and has banned the company from making devices with preloaded Google apps.

Article Details

Event Type: Botnet disruption and legal takedown
Impact: Google announced that it dismantled the XCPE botnet, which affected more than 1.3 million Android devices, primarily Android TV set-top boxes. Google says Videostrong Technology developed and operated the botnet, whose devices were used for ad fraud, data exfiltration, residential proxy services, and loading additional malware. Google took legal action against the botnet’s domains and servers and banned Videostrong from making devices with preloaded Google apps. The disruption likely severed access to at least 10 million additional devices, according to the article.