Google Partners with Law Enforcement and Global Security Firms to Dismantle XCPE Botnet Affecting Over 1.3 Million Android TV Devices Worldwide

Key summary

In an era where smart home devices play a significant role, the security of TV boxes is a target for cybercrime. Google has partnered with law enforcement agencies and global security firms to dismantle the XCPE botnet, which had embedded a backdoor in over 1.3 million Android TV devices worldwide. The XCPE malware was embedded during the manufacturing process by Videostrong, using a three-stage architecture: a primary backdoor in the /oem/ partition that operates with the highest privileges of the Android operating system and re-installs itself every time the device is rebooted; a loader and execution engine to evade security scans; and monetization modules to generate revenue through residential proxies, ad-fraud engines, and spyware. Google has permanently banned Videostrong and its affiliates, severing all ties and destroying the command and control infrastructure, in collaboration with agencies such as Japan's National Police Agency, Lumen, and HUMAN Security. They have seized the domain servers used for control, which may affect another 10 million devices. Google has also strengthened its firmware verification processes. Users should update their operating systems, avoid unknown and inexpensive devices, and reset their devices if they find suspicious apps or experience slow performance. Affected devices include telehealth devices, karaoke machines, and digital signage displays.