cyber.hendryadrian.com
Security News · arstechnica.com

Google Disrupts x.cpe Botnet on More Than 1.3 Million Android TV Devices

· Original article ↗

Summary

Google says it disrupted the x.cpe botnet, which infected more than 1.3 million certified Android TV boxes, mainly sold as MECOOL devices. The malware enabled proxy and ad-fraud activity; Play Protect remains disabled on affected boxes.

Key points

  • Google says x.cpe infected more than 1.3 million Google-certified Android TV devices, many sold under the MECOOL brand.
  • A remotely installed stub app had system-level permissions to install malware modules and disabled Play Protect.
  • Google describes x.cpe as evolving into a three-stage modular platform that sold access to third parties.
  • Google found devices running residential-proxy and ad-fraud modules; it says Videostrong could also issue commands, capture screens, and probe local networks.
  • Google worked with Japan's National Police Agency, Synthient, and Trend Micro, and took legal action against domains and servers used to operate the botnet.
  • Google says affected devices may still have Play Protect disabled and inert malware modules installed as system apps, which users cannot easily remove.
  • Trend Micro counted 1,472,554 infected devices, with most reported in Brazil, Malaysia, Iraq, Mexico, and Taiwan.

Article Details

Event Type
Botnet disruption and legal action
Impact
Google says it shut down the x.cpe botnet, which affected more than 1.3 million Google-certified Android TV devices; Trend Micro counted 1,472,554 infected devices. The compromised boxes were used for residential proxy traffic and ad fraud, and operators could also run terminal commands, capture screens, and probe local networks. Google says it took legal action to shut down the domains and servers used to operate and install the malware, and estimates Videostrong has been cut off from about 10 million compromised devices. The affected devices may still have Play Protect disabled and inert malware modules installed as system apps.

Threat Actors

Videostrong Technology Co.Google says Videostrong Technology used a backdoor to remotely install x.cpe on compromised devices and operate the botnet. Google reportedly observed Videostrong using the devices to run commands, capture screens, and probe local networks; Google determined the operation was not the work of a rogue actor.

Malware

XCPEGoogle’s Threat Intelligence Group says it has shut down a massive botnet called x.cpe.

Vendors

GoogleGoogle’s Threat Intelligence Group says it has shut down a massive botnet called x.cpe.Trend MicroGoogle worked with several other organizations to disrupt the x.cpe network, including Japan’s National Police Agency, Synthient, and Trend Micro.Videostrong Technology Co.Google says its screening process missed the malware due to “obfuscation techniques” employed by Shenzhen-based Videostrong Technology.

Products

Android TVAt its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes.MECOOLHowever, Videostrong’s compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online.Play ProtectIt also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.

Countries

AustraliaThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.BrazilThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.CanadaThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.GermanyThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.IraqThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.MalaysiaThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.MexicoThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.TaiwanThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.United KingdomThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.United StatesThe overwhelming majority were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also online in the US, Germany, the UK, Australia, and Canada.

Related Articles