Google and Partners Disrupt XCPE Botnet Linked to 1.3 Million Android Devices
Summary
Google and partners disrupted the XCPE botnet, which Google attributes with high confidence to Videostrong and says backdoored more than 1.3 million Android devices. Google says broader C2 disruption could cut access to at least 10 million more devices.
Key points
- Google's Threat Intelligence Group attributed the XCPE backdoor to Videostrong with high confidence, saying it had been embedded in Android-based devices since at least 2024.
- Google and partners, including Japan's National Police Agency, took legal action to disrupt servers and domains used to control the botnet and affiliate malware.
- Most affected devices were Android TV set-top boxes; Google also identified Android-based telehealth equipment, karaoke machines, and digital signage systems.
- Google said Videostrong sold affiliates access to infected devices, whose modules were used for ad fraud, residential proxy networks, and additional malware.
- Google reported that operators could capture screenshots, inject keystrokes, exfiltrate device and account information, and run commands on infected devices.
- Google assessed that disrupting affiliate command-and-control infrastructure could sever access to at least 10 million additional compromised devices.
Article Details
- Event Type
- Disruption of the XCPE botnet through legal action against Videostrong and disruption of its domains, servers, and command-and-control infrastructure.
- Impact
- Google and partners disrupted a botnet that had infected more than 1.3 million Android-based devices. Google assessed that disrupting affiliate-module C2 infrastructure would sever access to at least 10 million additional compromised devices. The article reports ad fraud, residential-proxy enrollment, and additional malware delivery; Google did not confirm that the described activity had occurred in corporate or healthcare environments.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterOperators executed shell scripts and commands on infected devices, including commands used to establish reverse shells.T1090 · ProxyXCPE-compromised devices were used as residential proxies to conceal malicious activity.T1113 · Screen CaptureOperators captured live screenshots from infected devices.
People
Threat Actors
Malware
Vendors
GoogleGoogle and industry partners disrupted the XCPE botnet, a cybercriminal operation that planted a backdoor in more than 1.3 million Android-based set-top boxes, turning consumer devices into infrastructure for maliciousVideostrong Technology Co."high confidence" by Google's Threat Intelligence Group (GTIG) to Android device manufacturer Videostrong Technology Co., involved deliberately embedding the XCPE backdoor malware in multiple device models and brands
Products
Androiddisrupted the XCPE botnet, a cybercriminal operation that planted a backdoor in more than 1.3 million Android-based set-top boxes, turning consumer devices into infrastructure for malicious activity.Android TVMost devices infected by the XCPE botnet were Android TV set-top boxes. However, the botnet also included other Android-based IoT devices, including telehealth equipment, karaoke machines, and digital signage systems,Google Play ProtectGoogle also urged Android users to stick to trusted app stores, review the permissions requested by third-party VPN and proxy applications, and ensure built-in security protections such as Google Play Protect are active.