Google Disrupts XCPE Botnet in 1.3 Million Android TV Boxes

• •Over 1.3 million Android TV boxes infected with a backdoor for ad fraud and proxy services.
• •Videostrong Technology Co. banned from producing certified Android devices due to intentional malware embedding.
• •Disruption of command-and-control domains expected to sever access to at least 10 million additional compromised devices.

Google and industry partners have dismantled the XCPE botnet, which infected over 1.3 million Android TV set-top boxes, primarily manufactured by Videostrong Technology Co. The company is accused of intentionally embedding a backdoor in the firmware to sell access to criminal affiliates, who used the devices for ad fraud and to route unauthorized traffic through victims' connections. The backdoor, identified as x.cpe, operates with system-level privileges and reinstalls itself if removed. Google's actions included legal measures to shut down command-and-control domains, disrupting access to at least 10 million additional compromised devices. The operation involved collaboration with Japan's National Police Agency and several security firms. Google has cut ties with Videostrong, banning the company from producing certified Android devices. This incident raises significant concerns about supply chain security in the Android ecosystem.