Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Google on Monday announced the dismantling of XCPE (aka X.CPE), a backdoor and botnet of more than 1.3 million Android set-top boxes.

The malware was developed and deployed by Videostrong Technology, a China-based original equipment manufacturer and original design manufacturer (OEM/ODM) of Android devices that also operated the botnet.

Videostrong, Google says, sold access to affiliates and loaded malicious modules on the backdoored devices, which were then abused for ad fraud and data exfiltration, as residential proxies, and for loading additional malware.

“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” the internet giant says.

As part of the takedown, Google took legal action to take down the botnet’s domains and servers, as well as the command-and-control (C&C) domains behind the additional modules loaded on the XCPE bots.

This likely resulted in severed access to at least 10 million other devices, as the module’s operators had diversified the distribution of their malware beyond XCPE.

Google believes the XCPE botnet was a deliberate operation by Videostrong, not the work of a rogue insider or the result of a development oversight. As such, it banned the company from making devices with preloaded Google apps.

“Google requires OEMs to go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem. However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot,” Google says.

Videostrong’s pre-installed malware has had a three-stage architecture consisting of the primary backdoor that persisted on the /oem/ partition, a loader and execution engine, and the monetization modules that could execute additional backdoors and load more modules.

The company provided affiliates with access to its backdoor, thus allowing them to monetize the infected devices for a long time.

“While the overwhelming majority of the infected devices in the XCPE botnet are Android TV set-top boxes, we observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices,” Google notes.

In XCPE’s disruption, Google received help from Japan’s National Police Agency, Lumen, Human Security, Plume, Synthient, and TrendAI. Technical details on the botnet and the takedown were published by Plume (PDF), Synthient, and TrendAI as well.

“While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient. Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain, and when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs,” Google said.

Related:Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Related:Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

Related:Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Related:FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist