Google, along with industry collaborators, has successfully dismantled the XCPE malware botnet, which comprises over 1.3 million Android TV streaming boxes. The company claims that the manufacturer intentionally infected these devices with malware to profit from cybercriminal activities.
Google confidently links the botnet to the Chinese manufacturer Videostrong Technology Co., accusing it of deliberately embedding a persistent backdoor in its devices and selling access to criminal partners.
These partners exploited the compromised devices to implement harmful modules for ad fraud, convert infected devices into residential proxies, and install further malware.
As part of the operation, Google reports that it has shut down XCPE command-and-control (C2) servers utilized by more than a dozen related malware families, effectively severing access to at least 10 million additional compromised devices.
These extra devices were infected through malware spread via methods other than XCPE, including retail set-top boxes, karaoke machines, and telehealth equipment. Google notes that not all of these devices run on Android.
Additionally, Google has ended its partnership with Videostrong, revoked its license to produce Android TV devices with pre-installed Google applications and services, and prohibited the company and its future affiliates from manufacturing certified Android devices or providing software to certified vendors.
According to a report released on Monday by Google’s Threat Intelligence Group (GTIG), “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”
The disruption involved collaboration with Japan’s National Police Agency and security firms such as Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which worked together to analyze the malicious infrastructure and disrupt its operations.
The XCPE botnet is distinct from other botnets that typically exploit vulnerabilities or deceive users into installing malware; it was integrated directly into the device firmware during the manufacturing process.
Google states that Videostrong had been creating and distributing the malware across various device brands and models for years, enhancing its capabilities to avoid detection and accommodate different criminal partners.
“We discovered this malicious software embedded in numerous device models and brands over several years, supported by dedicated infrastructure and continuously evolving configurations to evade detection and manage their affiliates,” Google explains.
The primary backdoor component, identified as x.cpe and com.oemservice, operates with Android system-level privileges.
The malware employs a modular design that separates its backdoor functionalities from modules intended to generate revenue for affiliates.
Once an infected device is powered on, XCPE connects to a command-and-control server on the anyevonline[.]com domain to retrieve connection details and credentials for an MQTT message broker, which is then utilized for command reception.
Google indicates that the malware utilizes various subdomains of anyevonline[.]com based on the Android version and device type. The MQTT broker, hosted at mqtt.szbboys[.]com, enabled operators to issue commands and deploy additional malware to infected devices.
Through this connection, operators can remotely manage compromised devices and execute malicious actions, including:
- Silently downloading and installing additional Android applications.
- Disabling Google Play Protect.
- Executing shell commands and scripts with system privileges.
- Capturing screenshots and injecting keystrokes.
- Gathering account information, device specifications, installed application lists, and system logs.
- Conducting network reconnaissance and establishing reverse shells.
The devices were also leveraged to generate revenue by installing malware modules from other operators, transforming the backdoor into a plug-in cybercrime platform for additional cybercriminals.
Source: Original article
