Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google dismantles XCPE botnet of 1.3 million devices and bans Videostrong Technology Co for intentional malware installation.
Google and partners disrupted the XCPE malware botnet on over 1.3 million Android TV boxes, attributing it to Videostrong Technology Co which installed persistent backdoors for ad fraud and proxies. The company banned the manufacturer and its affiliates from Android device production.
Unconfirmed: Google assesses with high confidence that the backdoor was intentionally developed by Videostrong
- Botnet consists of 1.3 million devices
- Attributed to Chinese manufacturer Videostrong Technology Co
- Coordinated with Japan's National Police Agency and security firms
- C2 servers taken down, affecting 10 million additional devices
- Malware used for ad fraud, residential proxies, and other backdoors
Impact: compromised devices for ad fraud and proxies
- 1.Banned Videostrong from producing Android devices
- 2.Revoked license to manufacture Android TV devices
- Products
- Android TV streaming boxes
- Threat actors
- Videostrong Technology Co
- Malware
- XCPE
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | anyevonline.com | e starts, XCPE contacts a command-and-control server on the anyevonline[.]com domain to obtain connection information and credentials f |
| domain | szbboys.com | and device type. The MQTT broker, which was hosted at mqtt.szbboys[.]com , allowed operators to send commands and deploy other mal |
| domain | videostrong.cn | ng Technology Co. Researchers also found that Videostrong's videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline |
From the original article
4 min read at bleepingcomputer.com
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1. 3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.