Botnet Infecting 1.3 Million Backdoored Android TVs Dismantled

Google has completely dismantled 'XCPE', a botnet that had consumed more than 1.3 million Android TV set-top boxes. A botnet refers to a network of malware-infected devices remotely controlled by hackers. The botnet lost control of its servers in late October through a Google-led takedown.

In a report released Monday (local time), Google Threat Intelligence Group (GTIG) assessed with 'high confidence' that Chinese manufacturer Videostrong Technology intentionally developed, distributed, and operated the backdoor. Google said Videostrong sold backdoor access to criminal partner companies and installed their malicious modules on infected devices. The modules included residential proxy software such as Linkfog, Honeygain, and NetNut, which relayed third parties' internet traffic without the owners' consent.

At the core of the backdoor was an app called x.cpe (com.oemservice). The app held system-level privileges and even disabled Google Play Protect. When a device powered on, XCPE connected to a command-and-control (C2) server and received MQTT message broker connection details. Operators could execute shell commands and scripts, capture screenshots, inject keystrokes, collect account and device information, conduct network reconnaissance, and establish reverse shells.