Google dismantles XCPE botnet on 1.3 million Android devices

Videostrong developed and deployed the malware on Android devices sold under multiple brands and models, according to Google. The China-based original equipment and original design manufacturer operated the botnet as a commercial service and sold affiliates access to infected devices.

The compromised devices were used for advertising fraud, data theft, residential proxy services and the installation of additional malware. Google took legal action to remove the botnet’s domains and servers, along with command-and-control domains linked to other malicious modules.

The disruption may have cut access to at least 10 million additional devices. Operators had distributed the malware beyond the XCPE botnet, according to Google.

Google determined that the operation was deliberate and was not caused by a rogue employee or an accidental development error. The company has barred Videostrong from producing devices with preloaded Google apps.

Videostrong used obfuscation to bypass Android compatibility and security checks, Google said. The company allegedly arranged for the malicious code to load after a device’s first boot, which allowed it to avoid detection during testing.

XCPE used three stages. A primary backdoor remained on the device’s original equipment manufacturer partition. A loader and execution engine managed the code, while monetization modules used the infected device, installed additional backdoors or loaded other software.

Videostrong gave affiliates access to the backdoor, allowing them to generate revenue from infected devices over an extended period. Most affected devices were Android TV set-top boxes. Investigators also found XCPE infections on telehealth devices, karaoke machines and digital signage equipment.

Google received assistance from Japan’s National Police Agency, Lumen, Human Security, Plume, Synthient and TrendAI. The company said the operators used dedicated infrastructure and frequently changed their configurations to avoid detection and manage affiliates.

“While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient,” Google said. The company added that backdoor operators, advertising-fraud groups and residential proxy providers operate through a connected supply chain and can switch to new loaders or rival software development kits after a disruption.