GBHackers weekly bulletin lists 50 stories from November 2–6
The roundup's lead blurbs cite bank theft, exploited WordPress and Zyxel flaws, and an Android TV botnet takedown.
Stories per day · 30 days
11 RSS
Relatedvideostrong13android12xcpe7iot5android-tv4anthropic4proxy4ai-safety3backdoor3ddos3gemma3mirai3php3php2shell3residential-proxy3self-replication3amadey2asd2
114 stories, newest first · one card per story
Stories tagged #botnet
Copeland XWEB controllers hijacked for spam and proxy traffic
SecurityScorecard linked three XWEB PRO units to coordinated outbound spam and only suspects CVE-2026-25085.
1
White House network serves as exit point for residential proxy services
Layer3 Intel detected proxy traffic exiting White House network 236 times in October, linked to infected devices running Rave.io proxy SDK.
Google disrupts 1.3 million device XCPE botnet
Google and partners disrupted an XCPE botnet controlling over 1.3 million Android devices, attributed to Videostrong Technology.
Google dismantles X.CPE botnet in Android TV boxes
Google with partners takedown of X.CPE botnet affecting over 1.3 million Android TV set-top boxes linked to Videostrong Technology.
Google dismantles botnet on 1.3 million Android TV boxes
Google seizes Videostrong domains, cutting off 10 million devices; Play Protect remains disabled on infected MECOOL boxes.
Videostrong backdoored 1.3 million Android TV boxes
Google discovered Videostrong backdoor in 1.3 million Android TV boxes that turned them into residential proxy botnet used by criminals.
1
Google Dismantles 1.3 Million Device XCPE Botnet Built by Videostrong
Videostrong built and operated XCPE backdoor in Android TV set-top boxes for ad fraud and proxy abuse, affecting over 1.3 million devices.
1
Google Disrupts 1.3 Million Device XCPE Botnet
Google takedowns XCPE botnet infecting 1.3 million Android devices and other IoT gear, developed by Videostrong for ad fraud and data theft.
Google Dismantles XCPE Botnet Infecting 1.3 Million Android Devices
The modular backdoor malware enabled ad fraud, proxy evasion, and further malware deployment on infected set-top boxes before Google and partners disrupted its infrastructure.
Google Dismantles 1.3 Million Device XCPE Botnet
Google banned Videostrong Technology for preinstalled malware in 1.3M Android devices that also impacted over 10M additional systems.
1
Google shuts down XCPE botnet on Android devices
Google dismantled the XCPE botnet infecting over 1.3 million Android devices sold by Videostrong after it evaded security checks.
Videostrong backdoor powers 1.3M Android TV box botnet
Coalition disrupts XCPE backdoor in Videostrong devices infecting 1.3M Android boxes across 200 countries.
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google dismantles XCPE botnet of 1.3 million devices and bans Videostrong Technology Co for intentional malware installation.
North Korean group steals $6.43B from Binance
Volt Typhoon uses silent train for zero-day attacks; Cursor extension has SSH backdoor and Polymarket loses $2.7M to hack.
1
Google disrupts 1.3 million-device Android botnet with Videostrong backdoor
Google and partners took down a botnet of 1.3 million Android TV boxes containing a persistent backdoor sold by device maker Videostrong.
Google dismantles XCPE botnet operated by Videostrong
Google banned Videostrong from Android devices after 1.3 million set-top boxes enrolled in the botnet.
Kairos botnet infects Linux hosts through passwordless Telnet
Nozomi honeypots saw the same Go binary, which holds thousands of TCP sockets open during each attack.
Kairos DDoS botnet opens idle TCP sessions from Linux hosts
Nozomi says the Go bot arrives over Telnet with an empty root password and has no persistence.
Australia severs Amadey control of about 180,000 infected computers
ASD operators accessed the Amadey backend and cut controller links without touching the infected machines.
ASD cuts an Amadey operator off from 180,000 infected computers
The disruption does not recover credentials already stolen, and ASD’s annual report does not describe the operation.
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.