Google has severed ties with Shenzhen-based Videostrong Technology Co. after discovering a backdoor in 1.3 million devices used for ad fraud and data exfiltration.
Google has announced it has dismantled a botnet consisting of more than 1.3 million Android devices and has "cut ties" with the manufacturer, Shenzhen-based Videostrong Technology Co. The company states that the manufacturer "intentionally" hijacked its devices with malware to conduct malicious activities for financial gain.
The infected devices, which include Android TV set-top boxes, telehealth equipment, karaoke machines, and digital signage devices, were used without owners' knowledge. According to Google, the devices were used for "ad fraud, data exfiltration, and routing unauthorized network traffic."
Google's Threat Intelligence Group stated, "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology." The company claims Videostrong monetized the backdoor by selling access to criminal affiliates, who then loaded malware modules onto the devices. These modules were used for conducting ad fraud, silently enrolling devices into residential proxy networks, and loading additional malware onto XCPE-compromised devices.
TrendAI, an enterprise unit of Trend Micro, reported that between June 3 and October 1, it counted 1,472,554 infected devices across 206 models. TrendAI also logged more than 3.8 million distinct home and mobile IP addresses connected to the operation during that period.
The backdoor, tracked as x.cpe, ran as a system app within the firmware with system-level privileges. According to Google's analysis, the malware would check in with command-and-control (C2) servers and wait for instructions. Once active, it could disable app-scanning checks in Google Play Protect to install software silently, capture screenshots, map local networks, and open reverse shells for remote command-line access.
Several entities assisted in the takedown, including Japan's National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Evidence for the attribution to Videostrong includes:
Google has permanently banned Videostrong from building or selling any certified Android devices and from supplying software for the Android platform. Google expects this action to cut off at least 10 million additional compromised devices operated by affiliates.
Remediation is noted to be difficult because the x.cpe backdoor is signed into the firmware with the manufacturer's key; it reinstalls itself after a device is reset. While Plume suggests a full factory reset, Synthient has advised consumers to discard affected boxes permanently. TrendAI stated that cleanup requires "vendor action, platform protection or replacement of the device."
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
Supermarkets in at least seven European countries reported cyberattacks on refrigeration systems, causing food spoilage and prompting investigations.
TechTrending
Snap has reached a settlement in a Los Angeles trial involving claims that its platform design caused depression, anxiety, and eating disorders in teenagers.
