Live Feeds
● LIVE Updated 1h ago · 11 sources tracked

One of Google’s Android partners turned 1.3 million set-top boxes into a botnet

Google and industry partners disrupted the XCPE botnet in late October, severing server control for over 1.3 million Android TV set-top boxes. The botnet utilized preinstalled malware to conduct advertising fraud and route third-party internet traffic through users' home connections. Google identified Shenzhen-based manufacturer Videostrong Technology Co. as the party responsible for intentionally installing the backdoor and selling access to criminals. While the command servers are down, the malware remains on the devices and cannot be removed by owners.

🎙️

Listen to Live Briefing

Real-time synthesized voice briefing · Live Feeds Desk

⏱ ~3 min
Speed:
RSS Source map (11)
⚡ Key Developments & Real-Time Context
Text size:
  • ✓ Google and industry partners dismantled the XCPE botnet involving more than 1.3 million Android TV set-top boxes.
  • ✓ The botnet used preinstalled malware to perform advertising fraud and route internet traffic through home connections.
  • ✓ Videostrong Technology Co., based in Shenzhen, China, is identified as the manufacturer that intentionally included the backdoor.
  • ✓ The malware remains on the affected devices and cannot be removed by the owners.
🛡️ Source Corroboration: 11 independent reporting domains (100% confidence) ⏱ Read time: ~2 min

What changed

Google and industry partners completed the takedown of the XCPE botnet servers and identified Videostrong Technology Co. as the intentional source of the backdoor.

Live updates

  1. Google and Partners Dismantle XCPE Botnet of 1.3 Million Android TV Boxes

    Google and industry partners disrupted the XCPE botnet in late October, severing server control for over 1.3 million Android TV set-top boxes. The botnet utilized preinstalled malware to conduct advertising fraud and route third-party internet traffic through users' home connections. Google identified Shenzhen-based manufacturer Videostrong Technology Co. as the party responsible for intentionally installing the backdoor and selling access to criminals. While the command servers are down, the malware remains on the devices and cannot be removed by owners.

    Why it matters

    The attack differs from typical malware because the backdoor was integrated during manufacturing rather than downloaded by users. This breach potentially impacted other IoT devices, including karaoke machines and healthcare equipment. Google has since severed ties with Videostrong.

    What is confirmed

    • Google and industry partners dismantled the XCPE botnet involving more than 1.3 million Android TV set-top boxes.
    • The botnet used preinstalled malware to perform advertising fraud and route internet traffic through home connections.
    • Videostrong Technology Co., based in Shenzhen, China, is identified as the manufacturer that intentionally included the backdoor.
    • The malware remains on the affected devices and cannot be removed by the owners.
    • Google has severed its ties with Videostrong Technology Co.

    Still unconfirmed

    • The takedown may sever the botnet's access to over 10 million additional compromised systems, including Android-based healthcare devices and karaoke machines.

    What to watch next

    • Evidence of other manufacturers using the x.cpe backdoor
    • Official response or legal action against Videostrong Technology Co.
    • Development of a firmware update to remove the persistent backdoor
    Sources used for this update (11)
    1. The Verge — One of Google’s Android partners turned 1.3 million set-top boxes into a botnet
    2. Google Cloud — Shutting the Door on the XCPE Botnet
    3. Krebs on Security — Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
    4. The Register — Cops bust botnet of 1.3M infected Android TV boxes
    5. The Hacker News — Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
    6. www.theverge.com — One of Google’s Android partners turned 1.3 million set-top ...
    7. cybersecuritynews.com — Google Dismantles 1.3 Million Device XCPE Botnet, Bans ...
    8. www.digitaltrends.com — Google shuts down massive botnet running on 1.3 million ...
    9. thehackernews.com — Google Disrupts 1.3 Million-Device Android Botnet, Says TV ...
    10. krebsonsecurity.com — Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into ...
    11. newsroom.trendmicro.com — Industry Takedown of Botnet Hidden in More Than 1.3 Million ...
    confidence 100%
📊

Community Sentiment: How do you assess this situation?

Voice your perspective · Real-time aggregated sentiment from the Live Feeds community