Google Dismantles 1.3 Million-Device Botnet, Accuses Chinese TV Box Maker of Installing Malware for Profit - NTD News

Google and its industry partners have taken legal action to dismantle a botnet that infected more than 1.3 million Android devices. The company accuses Chinese manufacturer Videostrong Technology Co. of deliberately installing hidden malware in TV boxes and other products to generate revenue from criminal affiliates.

The affected devices were primarily Android TV set-top boxes, but the malware was also found in telehealth devices, karaoke machines, and digital signage systems. The malicious software, known as XCPE or x.cpe, allowed operators to remotely control infected devices and load additional programs without users' knowledge or consent.

Chinese Manufacturer Accused

Founded in 2011 and headquartered in Shenzhen, Videostrong describes itself as an artificial intelligence hardware and OEM/ODM provider. The company claims to supply products to customers in more than 60 countries and regions, serving nearly 100 million households with products including Android TV boxes, streaming devices, and smart-home equipment.

Google states it has "high confidence" that Videostrong "intentionally developed, deployed, and operated" the malware "for financial gain." The company allegedly sold access to infected devices to criminal affiliates, who used them for online advertising fraud, routing internet traffic through users' home connections, and installing additional malware.

Malware Operation

The XCPE malware operates in three stages: a persistent backdoor, a stealthy loader, and swappable monetization modules. The first stage is a persistent backdoor called x.cpe, pre-installed in the device firmware with system-level privileges that automatically reinstalls itself on reboot if deleted.

The second stage is a stealthy loader known as com.abc.nexus, which uses anti-analysis tricks to dodge security scans. The third stage consists of monetization modules built by third-party affiliates that turn devices into proxy servers, ad-fraud engines, or installers for additional backdoors.

Google's Response

Google has taken legal action to disable the servers and internet domains used to control the botnet and has disrupted the control domains of more than a dozen other malware families. The company has cut ties with Videostrong and barred it from manufacturing or selling certified Android devices.

Google has also changed its device review process to address the security gap that Videostrong allegedly exploited. The company worked with several security partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to investigate and disrupt the malware.

TrendAI identified 1,472,554 infected devices across 206 models between June and October. Synthient published a list of 182 device model names associated with the campaign, while Plume identified more than a dozen device types communicating with the botnet's control servers, most carrying the MECOOL brand.

User Recommendations

Security experts advise consumers to treat affected devices as serious security risks and replace them rather than attempt to remove the malware, as the backdoor is embedded in firmware and reinstalls after restart. Plume recommends a full factory reset, though it may not remove the firmware-level backdoor itself.

For organizations, Synthient recommends using published indicators to identify potentially affected devices, disconnecting and replacing them, and blocking associated internet domains and IP addresses. It also advises keeping smart devices on separate network segments away from sensitive systems.

Google states its disruption would also affect criminal groups using the same malware through other channels, potentially cutting off access to at least 10 million additional compromised devices. The company emphasizes that while this action is significant, it will continue targeting this infrastructure to achieve lasting disruption.