Google has disrupted the XCPE botnet, which enrolled more than 1.3 million Android set-top boxes, after finding that their manufacturer deliberately built a backdoor into the devices.
In a report published Nov. 2, Google’s Threat Intelligence Group (GTIG) said it assessed “with high confidence” that Android device maker Videostrong Technology Co. developed, deployed and operated the malware for financial gain.
GTIG said the activity “wasn’t an isolated rogue insider or a development oversight.” According to the report, Videostrong sold access to infected devices to criminal affiliates, who used them for residential proxy services, advertising fraud and further malware installs.
The backdoor was preloaded in the device firmware and ran with Android system privileges, so devices were compromised before they ever reached a home or office network.
The botnet was globally dispersed. Most infected devices were Android TV set-top boxes, but GTIG also found the backdoor in telehealth devices, karaoke machines and digital signage.
Criminal Operators Used Devices for Proxies, Fraud and Surveillance
GTIG said affiliates turned the devices into residential proxy exit nodes, routing other people’s traffic through victims’ internet connections. One of the proxy services it named was NetNut, whose network Google and the FBI disrupted earlier this year.
Operators also stole account and device information and system logs, and GTIG observed them capturing screenshots, injecting keystrokes and running remote commands.
The malware switched off Google Play Protect, Android’s built-in app scanner. Uninstalling the malicious app did not remove it either: the copy stored in the firmware reinstalled it when the device rebooted.
GTIG said Videostrong had evolved the malware since at least late 2024, using obfuscation to exploit a gap in Google’s testing and loading malicious code only after a device’s first boot. Since August, operators had also installed components disguised as Android system apps.
Google Bans Videostrong and Tightens Its Checks
Google said it took legal action to take down the domains and servers controlling the botnet, along with the command infrastructure of more than a dozen malware families. GTIG said this would sever access to at least 10 million additional compromised devices.
Google also banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and cut ties with the company. It said it had changed its review process and was improving how it checks firmware integrity on certified Android TV devices.
The tech giant advised buyers to choose connected devices from reputable manufacturers, check its list of certified Android TV partners and keep Play Protect switched on. It also recommended that retailers and distributors require independent security audits from manufacturers and delist those implicated in supply-chain abuse.
Google said it worked on the disruption with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
