Google has banned a Chinese Android device maker and worked with partners to dismantle a botnet it helped to build containing more than 1.3 million set-top boxes, the tech giant has revealed.
In a blog post published on November 2, the Google Threat Intelligence Group (GTIG) said it assessed “with high confidence” that Android ODM/OEM Videostrong Technology was responsible for the XCPE botnet and backdoor.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” it explained.
“These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.”
Read more on botnets: Chinese Botnet Bypasses MFA in Microsoft 365 Attacks.
The industry action also disrupted XCPE command-and-control (C2) servers being used by criminal affiliates of Videostrong to install over a dozen malware families onto victims’ devices. This action helped to sever control of over 10 million of these compromised devices from the bot-herders, Google claimed.
“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” the blog continued.
“We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.”
Aside from set-top boxes, the XCPE botnet included compromised telehealth devices, karaoke machines, and digital signage devices.
How XCPE Worked
Google claimed Videostrong had been selling devices with the XCPE backdoor embedded into the firmware for several years.
The backdoor itself, x.cpe, operated at android.uid.system privilege level and automatically reinstalls itself from the /oem/ partition on reboot if a user tries to get rid of it.
On startup it contacts a C2 server and uses MQTT message broker for commands, enabling affiliates to remotely perform malicious actions such as executing shell scripts, disabling Google Play Protect, and silently installing additional apps.
Videostrong sought to further monetize the backdoor access to compromised devices by installing malware modules from other operators including residential proxy service providers like Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer.
These are another popular enabler of cybercrime including account takeover, payment fraud, ad/click fraud, web scraping and DDoS.
"While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient,” Google warned in closing.
“Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain, and when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs. Creating lasting change requires accountability across the hardware supply chain, the residential proxy industry and the broader technology ecosystem.”