Google Dismantles 1.3 Million Device XCPE Botnet
Original title: Google Dismantles 1.3 Million Device XCPE Botnet, Bans Android TV Maker Over Preinstalled Malware
Google banned Videostrong Technology for preinstalled malware in 1.3M Android devices that also impacted over 10M additional systems.
Google dismantled the XCPE botnet infecting 1.3 million Android TV set-top boxes and other IoT devices through preinstalled malware from Videostrong Technology. The malware rented connections for proxies, generated ad fraud, and installed further tools. Google banned the company and affiliates from Android certification and worked with partners to disrupt control infrastructure.
- Malware installed immediately after first boot
- Backdoor used MQTT for control on ports 3885-3887
- Devices turned into proxies and ad fraud tools
- Google banned Videostrong from certified Android devices
- Severed access to at least 10M additional compromised devices
Impact: Devices rented for criminal proxies and advertising fraud
- 1.Upgrade to fixed firmware
- 2.Check for preinstalled packages in OEM partition
- 3.Use trusted app stores and Play Protect
- Vendors
- GoogleVideostrong Technology
- Products
- Android TV set-top boxes
- Malware
- XCPE
- Victims
- Android device users
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | szbboys.com | T, a lightweight messaging protocol. Google identified mqtt.szbboys[.]com on ports 3885–3887. Operators could silently install apps |
From the original article
2 min read at cybersecuritynews.com
Google and industry partners have dismantled the XCPE botnet, which enrolled more than 1. 3 million set-top boxes through preinstalled malware. In a November 2 report, Google linked the operation with high confidence to Videostrong Technology, accusing the Android device maker of deliberately building and running the backdoor for profit.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.