Google shuts down global botnet running on certified Android devices

Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday. 

Videostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold. Those backdoors established XCPE, an expansive botnet that cybercriminals used to conduct ad fraud, steal data and route malicious traffic through residential proxy networks, according to a Google Threat Intelligence Group report.

Google took legal action to shut down the domains and servers Videostrong used to control the botnet. The company also took down command-and-control domains that more than a dozen malware families ran as modules through the XCPE backdoor, claiming it disrupted access to at least 10 million additional compromised devices from various manufacturers.

Videostrong sold Android devices with pre-installed malware for years, slipping by Google’s security tests by loading the malicious code after the device’s first boot. “The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections,” Charley Snyder, head of disruption operations at GTIG, told CyberScoop.

Snyder declined to say when or how Google first became aware of the approved vendor running a botnet on Android-powered devices. 

“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” Google researchers wrote in the report. “We believe this campaign wasn’t an isolated rogue insider or a development oversight.”

Google banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process to detect and stop similar activities in the future. Yet, Snyder said the company isn’t sharing specifics on these changes because it doesn’t want to provide threat actors insights that might help them circumvent these additional protections.

Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs. 

“Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors,” researchers wrote in the report. “This led to a variety of malicious activities being conducted on and through the devices, including ad-fraud, data exfiltration, and routing malicious network traffic through the devices.”

The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers. Nearly 44,000 infected devices were based in the United States between June and October.

Google also partnered with Japan’s National Police Agency, Lumen Technologies, Human Security, Plume and Synthient to study and disrupt the botnet. 

The company said the dismantling of XCPE “seriously impacted over a dozen malicious actors,” yet it warned that the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain.

Latest Podcasts

Government

• Federal court tosses Trump lawsuit challenging Alaska Senate certification

• Defense contractor pleads guilty to aiding North Korean remote worker scheme

• Leaked DHS employee archive, Icepick, faces challenges to stay online

• Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists

Technology

• Apple notifications alert victims in 99 countries about mercenary spyware infections

• All the security risks Anthropic is worried about before its IPO 

• Senators say targeted ads are a security risk. Ad groups say the critics are off base.

• eMudhra kills its certificate business after researchers cracked its private keys in under a second

Threats

• Researchers uncover Volt Typhoon’s covert, ephemeral network

• Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles

• Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison

• Experts temper emergency-level alarms over critical Brotli defect

Policy

• California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

• National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals

• Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion

• CISA publishes strategy with eye on the next four years