Google dismantles 1.3M-device XCPE botnet operated by Videostrong
Original title: Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers
Videostrong developed XCPE backdoor in 1.3M Android TV boxes for proxy abuse and ad fraud, now banned from Google ecosystem.
Google and partners dismantled the XCPE botnet controlling over 1.3 million set-top boxes. The backdoor was built by Videostrong to monetize devices as residential proxies and for ad fraud by selling access to criminal affiliates. The malware persists through OEM partitions and uses MQTT for C2, downloading additional modules from GitHub. Google banned Videostrong from all Google-certified devices and took legal action against control domains.
Unconfirmed: Google assessment with high confidence but based on investigation findings
- 1.3 million Android TV set-top boxes enrolled
- Backdoor preloaded in firmware and runs with system privileges
- Modules downloaded via MQTT from GitHub releases
- Videostrong banned from Google devices and supply chain
- Multiple proxy and ad-fraud kits installed without consent
Impact: device takeover for proxy servers and ad fraud
- 1.Monitor for unauthorized Android TV apps
- 2.Review network traffic for anomalous MQTT connections
- Vendors
- GoogleVideostrong
- Products
- Android TV set-top boxes
- Threat actors
- Videostrong
- Victims
- end users of set-top boxes
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | szbboys.com | ices are assigned to one of six timezone-based pools on ott.szbboys[.]com. Devices report their bandwidth use and alarms back, so t |
From the original article
5 min read at securityaffairs.com
Google dismantled a 1. 3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.