Google Dismantles 1.3 Million Device XCPE Botnet Built by Videostrong
Original title: Inside XCPE, the botnet that turned set-top boxes into proxy servers
Videostrong built and operated XCPE backdoor in Android TV set-top boxes for ad fraud and proxy abuse, affecting over 1.3 million devices.
Google dismantled the XCPE backdoor developed by Videostrong Technology Co. The backdoor enrolled more than 1.3 million set-top boxes in a botnet. Videostrong deliberately created, spread, and operated the backdoor to monetize access by selling to criminal affiliates and installing their malware modules. The malware enables ad fraud, residential proxy networks, and additional malicious software. Google took legal action against control domains and servers, and banned Videostrong from Google certified devices.
- Backdoor preloaded in firmware runs with system privileges.
- Devices include Android TV set-top boxes, telehealth, karaoke machines.
- One device can run multiple proxy kits including AppSalt and Linkfog.
- Ban issued to Videostrong from making devices with pre-installed Google apps.
Impact: Botnet enrollment for ad fraud and proxy abuse
- 1.Check for unauthorized software on devices
- 2.Review device firmware for backdoor
- Vendors
- Videostrong Technology Co.
- Threat actors
- Videostrong
- Organizations
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | szbboys.com | ices are assigned to one of six timezone-based pools on ott.szbboys[.]com. Devices report their bandwidth use and alarms back, so t |
From the original article
5 min read at securityaffairs.com
Google dismantled a 1. 3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.