1,3 milliondan ortiq Android qurilmasidan iborat botnet, asosan televizor pristavkalari, oktyabr oxirida Google boshchiligidagi operatsiyada serverlar nazoratini yo'qotdi.
Google qurilma ishlab chiqaruvchisi Videostrong qutilarga ataylab orqa eshik o'rnatgan va jinoiy shaxslarga kirish sotganiga "yuqori ishonch" bilan ishonadi.
Ular qutilardan reklama firibgarligi uchun va boshqa odamlarning internet-trafikini egalarining uy ulanishlari orqali o'tkazish uchun foydalangan. Orqa eshik hali ham qutilarda saqlanib qolgan va egalar uni o'zlari o'chira olmaydi.
Shenzhen, Xitoyda joylashgan Videostrong o'z nomi va boshqa brendlar uchun Android TV qutilari va boshqa qurilmalar ishlab chiqaradi. x.cpe deb nomlangan orqa eshik bir necha yil davomida ko'plab qurilma modellari va brendlariga o'rnatilgan. Google bu holatni ichki xoin yoki xato deb hisoblamaydi.
Google botnetni boshqaradigan domen va serverlarni yo'q qilish uchun huquqiy choralarni qo'lladi. Shuningdek, orqa eshik orqali yuklangan o'ndan ortiq zararli dastur oilalarining nazorat domenlarini ham yo'q qildi. Operatsiyada Yaponiya Milliy Politsiya Agentligi, Lumen, HUMAN Security, Plume, Synthient va TrendAI Google bilan hamkorlik qildi.
Zararli dastur ortida turgan jinoiy shaxslar uni boshqa yo'llar bilan ham tarqatgani sababli, Google bu harakat ularning kamida 10 milliondan ortiq boshqa zararlangan qurilmalarga kirishini to'xtatishini kutmoqda. U orqa eshik operatorlari va ulardan sotib olgan jinoiy shaxslar tizimning bir qismi buzilganda tezda yangi vositalarga o'tishini ogohlantiradi.
Google Videostrong bilan aloqalarni uzdi. Kompaniyani va kelajakdagi har qanday sho'ba yoki filiallarini sertifikatlangan Android qurilmalarini ishlab chiqarish yoki sotishdan, shuningdek, boshqa sertifikatlangan qurilma ishlab chiqaruvchilarga dasturiy ta'minot yetkazib berishdan taqiqladi.
Orqa Eshik Nima Qildi
Google tahliliga ko'ra, x.cpe orqa eshigi tizim ilovasi sifatida proshivka ichida ishlaydi va tizim darajasidagi kirish huquqiga ega. U botnetning buyruq va nazorat (C2) serverlariga hisobot beradi va buyruqlarni kutadi. Dasturiy ta'minotni yashirincha o'rnatish uchun avval Androidning o'rnatilgan xavfsizlik funksiyasi — Google Play Protect'dagi ilova tekshiruvlarini o'chiradi.
Orqa eshik orqali botnet operatorlari egasi bilmasdan ilovalarni o'rnatishi, buyruqlarni bajarishi, ekranni yozib olishi va quti joylashgan tarmoqni xaritalashi mumkin edi.
Google Videostrong operatorlari bu kuchlardan ba'zilarini ishlatganini ko'rdi. Ular jonli skrinshotlar oldi, tugmachalarni yubordi, hisob ma'lumotlari, qurilma ma'lumotlari, ilovalar ro'yxati va tizim jurnallarini nusxaladi, shuningdek, qutiga masofadan buyruq qatori beradigan teskari qobiqlarni ochdi.
Jinoiy modullarning aksariyati, orqa eshik orqali yuklangan qo'shimcha dasturlar, qutilarni turar-joy proksi-serverlariga aylantirdi yoki ularning ortiqcha tarmoq kengligini sotdi. Turar-joy proksi xizmati uy internet ulanishiga kirish sotadi, shunda mijozning trafiki oddiy uy xo'jaligidan kelayotgandek ko'rinadi. Boshqa modullar onlayn reklamalarning soxta ko'rinishlarini yaratdi.
Zararlangan qurilmalarning aksariyati Android TV pristavkalari, lekin orqa eshik telemeditsina qurilmalari, karaoke mashinalari va raqamli belgilar (digital signage) da ham topildi.
Trend Micro korporativ biznes birligi TrendAI 3-iyun va 1-oktyabr oralig'ida 206 model bo'yicha 1 472 554 zararlangan qurilmani sanadi va haqiqiy son kamida shuncha yuqori ekanini aytadi. Malayziya, Braziliya, Iroq, Meksika va Tayvan eng ko'p zararlangan davlatlar edi. AQSh, Germaniya, Buyuk Britaniya, Avstraliya va Kanadada har birida taxminan 26 000 dan 42 000 gacha qurilma bor edi.
Egalari Nima Qilishi Mumkin
Proksi tarmoqlari va botnetlarni kuzatuvchi Synthient kampaniyada ko'rilgan 182 qurilma model nomlari ro'yxatini e'lon qildi. Ro'yxat faqat model nomi qutining zararlanganligini tasdiqlamasligini ogohlantiradi.
Synthient hisobotida Videostrong bilan bog'langan MECOOL brendli qutilarga e'tibor qaratiladi. U MECOOL KM9PRO Max sotib oldi va orqa eshik oldindan o'rnatilganini aniqladi. Internet provayderlari uchun Wi-Fi dasturiy ta'minotini ishlab chiqaruvchi Plume botnet nazorat serveridan foydalanadigan o'ndan ortiq turli qurilmani topdi, ularning aksariyati MECOOL'dan.
x.cpe proshivkaning bir qismi bo'lgani sababli, uni o'chirish doimiy emas. Quti qayta ishga tushganda u o'zini qayta o'rnatadi. TrendAI orqa eshik ishlab chiqaruvchining kaliti bilan imzolangan tizim ilovasi sifatida ishlashini aytadi, shuning uchun tozalash "ishlab chiqaruvchi chorasi, platforma himoyasi yoki qurilmani almashtirish"ni talab qiladi.
Plume modullar qo'shimcha orqa eshiklar o'rnatgan bo'lishi mumkinligi sababli to'liq zavod sozlamalariga qaytarishni tavsiya qiladi, lekin qayta sozlash x.cpe'ni o'zi o'chiradimi-yo'qmi aytmaydi. Synthient iste'molchilarga qutilarni butunlay tashlab yuborishni tavsiya qiladi, chunki ular yuqori zararli dastur xavfini tug'diradi.
Tashkilotlar uchun Synthient quyidagi choralarni tavsiya qiladi:
- MECOOL yoki shunga o'xshash qurilmalarni tarmoqda topish uchun e'lon qilingan indikatorlardan foydalaning.
- Topilgan har qanday qurilmani uzib, tashlab yuboring.
- Hisobotda ro'yxatga olingan nazorat domenlari va IP manzillarini bloklang.
- Boshqa aqlli qurilmalarni sezgir tizimlardan alohida tarmoq segmentlarida saqlang.
TrendAI masofadan ishlaydigan xodimlari bo'lgan kompaniyalarga uy tarmoqlaridagi boshqarilmaydigan iste'mol qurilmalarini hujum yuzasi qismi sifatida ko'rib chiqishni va korporativ kirishni boshqariladigan qurilmalar ortida saqlashni tavsiya qiladi.
Videostrong Qanday Aniqlangan
Google hisobiga ko'ra, x.cpe C2 serveridan sozlamalarni Videostrongning boshqa ilovalariga, jumladan YokaTV Player striming ilovasiga o'tkazadi. Botnet paketlarini joylashtirgan GitHub hisoblaridan biri yf-videostrong deb nomlangan.
Google bilan hamkorlik qilgan Synthient ham Videostrong operatsiyani yuqori ishonch bilan boshqarishini xulosa qildi. U botnet serverlaridan biridagi ochiq papkada Videostrong tadqiqot va rivojlantirish direktori imzolagan hujjatni va operatorlar nazorat paneli bilan bir xil IP manzilini baham ko'radigan Videostrong veb domenini ko'rsatadi.
Plume Videostrong bu qurilmalar uchun ham proshivka, ham ularni masofadan boshqarish vositalarini yetkazib berishini aniqladi.
Google Qurilma Sinovlaridagi Bo'shliq
Google qurilma ishlab chiqaruvchilardan moslik va xavfsizlik sinovlari to'plamidan o'tishni talab qiladi. U Videostrong o'z kodini bu sinovlardagi bo'shliqni chetlab o'tish uchun yashirganini va zararli kodni qurilmaning birinchi ishga tushishidan keyin yuklaganini aytadi.
Google o'z tekshiruv jarayonini o'zgartirdi va sertifikatlangan Android TV qurilmalarining proshivkasini tekshirishni yaxshilamoqda.
2-noyabr holatiga ko'ra, Videostrong o'z veb-saytida "Google Certified Android TV Box" va "Google Certified Android TV Stick" deb ataladigan mahsulotlarni ro'yxatga olgan.
Plume botnetga Google sertifikatlangan qurilmalar ham, Android Open Source Project (AOSP) versiyasini ishlatadigan qurilmalar ham kirganini aytadi. Google hisobotida sertifikatlangan qurilmalarning qancha qismi zararlangani aytilmagan.
Google 2025-yil iyulida BadBox 2.0 botneti bo'yicha sudga murojaat qilganida, 10 milliondan ortiq qurilma sertifikatlanmagan edi.
A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google.
Google says it is highly confident that device maker Videostrongintentionally put a backdoor in the boxes and sold access to criminals.
They used the boxes for ad fraud and to pass other people's internet traffic through owners' home connections. The backdoor is still on the boxes, and owners cannot remove it themselves.
Videostrong, based in Shenzhen, China, makes Android TV boxes and other devices under its own name and for other brands. The backdoor, called x.cpe, was built into many device models and brands over several years. Google does not believe a rogue insider or a mistake was to blame.
Google used legal action to take down the domains and servers that controlled the botnet. It also took down the control domains of more than a dozen malware families loaded through the backdoor. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI worked with Google on the operation.
Because the criminals behind that malware also spread it in other ways, Google expects the action to cut off their access to at least 10 million more infected devices. It warns that backdoor operators and the criminals who buy from them quickly switch to new tools when one part of their setup is disrupted.
Google has cut ties with Videostrong. It banned the company, and any future subsidiaries or affiliates, from building or selling certified Android devices and from supplying software to other certified device makers.
What the Backdoor Did
The x.cpe backdoor runs as a system app inside the firmware, with system-level access, according to Google's analysis. It reports to the botnet's command-and-control (C2) servers and waits for orders. To install software silently, it first turns off the app checks in Google Play Protect, Android's built-in security feature.
Through the backdoor, the botnet's operators could install apps without the owner knowing, run commands, capture the screen and map the network the box sits on.
Google says it saw Videostrong's operators use some of these powers. They took live screenshots, sent keystrokes, copied out account details, device information, app lists and system logs, and opened reverse shells, which give a remote command line into the box.
Most of the criminals' modules, the add-on programs loaded through the backdoor, turned the boxes into residential proxies or sold their spare bandwidth. A residential proxy service sells access to a home internet connection, so a customer's traffic appears to come from an ordinary household. Other modules faked views of online ads.
Most infected devices are Android TV set-top boxes, but the backdoor also turned up on telehealth devices, karaoke machines and digital signage.
TrendAI, Trend Micro's enterprise business unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, and says the real number is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The U.S., Germany, the U.K., Australia and Canada each had about 26,000 to 42,000.
What Owners Can Do
Synthient, which tracks proxy networks and botnets, has published a list of 182 device model names seen in the campaign. The list warns that a model name alone does not confirm that a box is infected.
Synthient's report focuses on MECOOL-branded boxes, which it links to Videostrong. It bought a MECOOL KM9PRO Max and found the backdoor preinstalled. Plume, which makes Wi-Fi software for internet providers, found more than a dozen different devices using the botnet's control server, most of them from MECOOL.
Because x.cpe is part of the firmware, removing it does not stick. It reinstalls itself when the box restarts. TrendAI says the backdoor runs as a system app signed with the maker's key, so cleanup needs "vendor action, platform protection or replacement of the device."
Plume recommends a full factory reset, because the modules may have installed more backdoors, but it does not say whether a reset removes x.cpe itself. Synthient goes further, telling consumers to throw the boxes away for good because they pose a high risk of malware.
For organizations, Synthient recommends these steps:
- Use its published indicators to find MECOOL or similar devices on the network.
- Disconnect and throw away any that turn up.
- Block the control domains and IP addresses its report lists.
- Keep other smart devices on separate network segments, away from sensitive systems.
TrendAI advises companies with remote staff to treat unmanaged consumer devices on home networks as part of their attack surface, and to keep corporate access behind managed devices.
How Videostrong Was Identified
In Google's account, x.cpe passes settings from the C2 server to other Videostrong apps, including its YokaTV Player streaming app. One of the GitHub accounts that hosted the botnet's packages is named yf-videostrong.
Synthient, which worked with Google, also concluded with high confidence that Videostrong runs the operation. It points to a document signed by Videostrong's research and development director in an open folder on one of the botnet's servers, and to a Videostrong web domain that shares an IP address with the operators' control panel.
Plume found that Videostrong supplies both the firmware for these devices and tools to manage them remotely.
A Gap in Google's Device Tests
Google requires device makers to go through a set of compatibility and security tests. It says Videostrong hid its code to bypass a gap in those tests and loaded the malicious code after a device's first boot.
Google has changed its review process and is improving its checks of the firmware on certified Android TV devices.
As of November 2, Videostrong's own website listed products it calls "Google Certified Android TV Box" and "Google Certified Android TV Stick."
Plume says the botnet included both Google-certified devices and devices running the Android Open Source Project (AOSP) version. Google's report does not say how many certified devices were affected.
When Google sued over the BadBox 2.0 botnet in July 2025, the more than 10 million devices involved were uncertified.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
