Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access

Key Points:

• A botnet of over 1.3 million Android devices, mainly TV set-top boxes made by Videostrong, was dismantled in late October through a Google-led takedown involving multiple partners and law enforcement agencies.
• Google alleges Videostrong intentionally embedded a persistent backdoor called x.cpe in its devices, enabling criminals to control them for ad fraud, residential proxy services, and traffic routing, with the backdoor surviving resets and requiring vendor intervention to remove.
• The infected devices span multiple brands and models, including Android TV boxes, telehealth devices, karaoke machines, and digital signage, with the highest infections reported in Malaysia, Brazil, Iraq, Mexico, and Taiwan.
• Google has banned Videostrong and its affiliates from producing certified Android devices and supplying software, and has updated its certification process to close security gaps that allowed the backdoor to bypass initial device tests.
• Owners and organizations are advised to identify potentially infected devices using published indicators, isolate or discard compromised units, and implement network segmentation to protect sensitive systems, as the backdoor cannot be reliably removed by users.