Google dismantles x.cpe botnet running on 1.3 million Android TV devices

Google’s Threat Intelligence Group (GTIG) has announced the shutdown of a massive botnet known as x.cpe. At its peak, the botnet operated on more than 1.3 million Android TV devices, many of which were Google-certified boxes.

The x.cpe Botnet Operation

According to Google, the malware evolved from a single-stage dropper into a modular three-stage platform. The botnet primarily utilized a stub application, identified as x.cpe or com.oemservice, which possessed system-level permissions to install various malware modules. This application also disabled Play Protect to prevent the detection of silently installed packages.

Google reported that the botnet was used for several purposes:

• Routing large volumes of traffic via residential proxies.
• Engaging in ad fraud schemes.
• Allowing operators to run terminal commands, capture screens, and probe local networks.

Google stated that "Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices."

Manufacturer Involvement and Detection

Google identified Shenzhen-based Videostrong Technology as the entity responsible for the campaign. While manufacturers must undergo a certification process to access Google apps and branding, Google says its screening process missed the malware due to "obfuscation techniques" used by Videostrong. The malware was able to bypass detection by using a backdoor to install itself remotely after the devices were set up and online.

Many of the affected devices were sold under the MECOOL brand. Synthient, a startup that tracks proxy providers, reported that MECOOL boxes bundled the malware from Videostrong Technology Co. and installed other proxy components.

Takedown and Impact

Google worked with several organizations to disrupt the network, including Trend Micro, Synthient, and Japan’s National Police Agency. Google has taken legal action to shut down the domains and servers used by Videostrong to operate the botnet.

Key statistics regarding the impact include:

• Infected Devices: Google reported over 1.3 million devices; Trend Micro counted 1,472,554 infected devices.
• Potential Reach: Experts suggest the action may sever access to an additional 10 million compromised devices, including other IoT products like telehealth devices and karaoke machines.
• Geographic Distribution: The majority of infections were located in Brazil, Malaysia, Iraq, Mexico, and Taiwan, with tens of thousands also found in the US, Germany, the UK, Australia, and Canada.

As a result of the findings, Google has ended its relationship with Videostrong Technology Co. and its subsidiaries, prohibiting them from using Google’s Android apps and services.

Why it matters

Because the malware was loaded as a system app, users cannot easily remove the inert modules. Additionally, Play Protect remains disabled on these devices. While the takedown aims to make the devices safer, the presence of the installed modules remains a concern for affected users.

---

Sources

• arstechnica.com: Google dismantles botnet secretly running on 1.3 million Android TV boxes - Ars Technica
• krebsonsecurity.com: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies – Krebs on Security

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.