Google Disrupts XCPE Botnet on 1.3 Million Devices

Google said on November 2 that it and industry partners disrupted XCPE, a botnet that enrolled more than 1.3 million set-top boxes.

Google assesses that Videostrong intentionally embedded the backdoor in device firmware and sold access to criminal affiliates. The secondary modules performed advertising fraud, operated residential proxies and installed additional malware. Attribution is Google Threat Intelligence Group’s assessment, rather than a finding independently established by this article.

The response included legal action against command infrastructure, a ban on Videostrong making certified Android devices, and changes to firmware review. Disruption does not mean infected devices are clean: Google describes automatic reinstallation from the OEM partition. Owners should check their model with a reputable manufacturer and isolate suspicious devices from the network.

Source: Google Threat Intelligence Group