Google dismantles XCPE botnet consisting of 1.3 million Android devices

Google led an operation to disrupt a global botnet composed of more than 1.3 million Android devices in late October, according to reports from The Hacker News, BleepingComputer, and CyberScoop. The infrastructure primarily consisted of Android TV set-top boxes infected with the XCPE malware. [1][2][3]

The Hacker News and BleepingComputer both reported that Google directly blamed hardware manufacturer Videostrong for the compromise. Google stated with high confidence that Videostrong intentionally installed a backdoor on the set-top boxes during manufacturing to sell criminal access and generate revenue through cybercrime activities. [1][3]

A botnet is a group of internet-connected devices running malicious software that allows operators to access connections, steal data, or launch denial-of-service attacks using command and control servers. The infected Android TV devices lost control of these central command servers following the coordinated takedown. [1][7]

Following the investigation into the XCPE malware network, Google has banned the device maker Videostrong, according to reports by BleepingComputer and SQ Magazine. [3][5]