Google dismantles XCPE botnet operated by Videostrong
Original title: Shutting the Door on the XCPE Botnet
Google banned Videostrong from Android devices after 1.3 million set-top boxes enrolled in the botnet.
Google and partners took down the XCPE backdoor in set-top boxes. The backdoor enrolled over 1.3 million devices into a botnet for financial gain by Videostrong Technology Co. Videostrong sold access to criminal affiliates who loaded modules for ad-fraud, proxy networks and additional malware. Google disrupted C2 domains and banned Videostrong from certified Android devices. The company also updated its firmware review process.
- 1.3 million devices enrolled
- Affiliates loaded modules beyond XCPE
- Disrupted C2 for at least 10 million additional devices
- Banned Videostrong from Android devices
- Worked with Japan’s National Police Agency
- Products
- Android
- Threat actors
- Videostrong Technology Co.
- Malware
- XCPEcom.abc.nexus
- Countries
- Japan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | szbboys.com | lation (NAT) boundaries. It also returns a URL ( http://ott.szbboys[.]com:8000/cpe/file/upload for uploading files, logs, or diagno |
From the original article
12 min read at cloud.google.com
Written by: Charley Snyder Introduction Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1. 3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.
By Google Threat Intelligence Group · cloud.google.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.