Google Disrupts 1.3 Million Device XCPE Botnet
Original title: Google Dismantles XCPE Botnet of 1.3 Million Android Devices
Google takedowns XCPE botnet infecting 1.3 million Android devices and other IoT gear, developed by Videostrong for ad fraud and data theft.
Google announced the disruption of XCPE, a backdoor and botnet with over 1.3 million Android set-top boxes and IoT devices. The malware was developed and deployed by Videostrong Technology in China, which sold access to affiliates and loaded modules for ad fraud, data exfiltration, and additional malware. Google took legal action against domains and C&C servers, receiving support from Japanese authorities and security firms. The botnet used a three-stage architecture persisting on OEM partitions.
- Malware loaded on various Android device models and brands over multiple years
- Google banned Videostrong from preloading Google apps
- Help received from Japan’s National Police Agency, Lumen, Human Security, Plume, Synthient and TrendAI
- Severed access to at least 10 million other devices via diversified distribution
Impact: ad fraud, data exfiltration, and residential proxy abuse on infected devices
| Product | Affected |
|---|---|
| Videostrong Technology Android set-top boxes and IoT devices | — |
- 1.Google took legal action to take down botnet domains and C&C servers
- Vendors
- GoogleVideostrong Technology
- Threat actors
- Videostrong Technology
- Malware
- XCPE
- Countries
- China
From the original article
2 min read at securityweek.com
The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology. The post Google Dismantles XCPE Botnet of 1. 3 Million Android Devices appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.