Google Dismantles XCPE Botnet Infecting 1.3 Million Android Devices
Original title: Google Dismantles XCPE Botnet That Infected 1.3 Million Android TV Devices With Preinstalled Malware
The modular backdoor malware enabled ad fraud, proxy evasion, and further malware deployment on infected set-top boxes before Google and partners disrupted its infrastructure.
Google Threat Intelligence Group dismantled the XCPE botnet that infected more than 1.3 million Android TV devices with a firmware-level backdoor. The backdoor, operated by Videostrong Technology Co. for profit, supported monetization modules for ad fraud, residential proxies, and additional malware. Google disrupted command-and-control domains, banned Videostrong from future Android certifications, and cooperated with industry partners including Japan's National Police Agency.
- Infected over 1.3 million Android set-top boxes across 206 models
- Modular architecture with primary backdoor and loaders
- Disrupted C2 domains and banned Videostrong from certified devices
Impact: Control over infected devices for ad fraud and proxy routing
| Product | Affected |
|---|---|
| Google Android | — |
- 1.Replace affected set-top boxes
- 2.Isolate smart devices on guest networks
- 3.Block traffic to szbboys[.]com
- Vendors
- Products
- Android
- Threat actors
- Videostrong Technology Co.
- Malware
- XCPE
- Victims
- Android TV set-top boxes
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | anyevonline.com | block and monitor traffic to the domains szbboys[.]com and anyevonline[.]com. They should also be vigilant for unexpected MQTT or prox |
| domain | szbboys.com | y establish a persistent MQTT connection to the broker mqtt.szbboys[.]com. Through this MQTT connection, operators can discreetly i |
| ipv4 | 219.134.163.210 | ermore, partners recommend blocking the broker IP addresses 219.134.163[.]210 and 219.134.163[.]211. Google warns that backdoor operato |
From the original article
3 min read at gbhackers.com
Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1. 3 million Android set-top boxes.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.