Google Finds XCPE Botnet Mostly Infects Android TV Set-Top Boxes

Google Cloud has identified Android TV set-top boxes as the overwhelming majority of devices infected by the XCPE botnet, which loads software that routes outside traffic through victims’ equipment . Its researchers also found infected telehealth equipment, karaoke machines and devices used for digital signage. Google says residential proxy and bandwidth-sharing software dominate the botnet’s money-making activity, alongside modules used for advertising fraud.

A single infected device can carry as many as three residential proxy SDKs, according to Google, giving operators several ways to earn money from the same equipment. Google attributes the effort to maximize revenue from infected devices to Videostrong. In its examination of AppSalt, a proxy SDK belonging to Honeygain, Google found that the software sets a consent flag without presenting users with a consent screen.

That AppSalt software also checks where its host application came from and halts if it was installed through Google Play Store. After initialization, it contacts command servers and connects to proxy gateways whose addresses can be changed remotely. Honeygain belongs to Oxylabs, according to Google’s analysis.

The com.abc.nexus component launches bundled native programs with system or root privileges and can run SDKs built into the application. It also receives instructions from x.cpe to fetch further modules, including native programs and separate Android application packages. One module, BWM / IPWeb, collects device telemetry, registers with a remote server and creates a tunnel that carries arbitrary traffic for a remote threat actor.

Other modules extend access through additional proxy providers: Google observed GaGaNode starting both PopaNet/NetNut and EarnFM Fleet SDKs. Google says the command infrastructure used by x.cpe-connected Popanet samples had already been removed during its earlier NetNut disruption. EarnFM’s Fleet SDK maintains a connection through which it receives instructions to specified remote hosts, supporting TCP and UDP traffic.

The infection also loads backdoors capable of fetching more software, including Spirit, which gathers hardware, operating system, brand and location information before requesting additional modules. Google observed Spirit downloading further malware used to generate revenue, including families also loaded directly by com.abc.nexus. Another backdoor, Moyu, combines hidden advertising click and conversion fraud with persistent clipboard hijacking, additional code execution and a separate residential proxy trojan.