Google announced today that it has worked with industry partners to dismantle the XCPE botnet, which had turned more than 1.3 million Android TV set-top boxes into residential proxies. The devices, primarily manufactured by Videostrong Technology Co. in China, shipped with pre-installed malware that rented out users’ Internet connections without consent.
The Google Threat Intelligence Group report states that the botnet also enabled advertising fraud and distributed additional malware modules from criminal affiliates. Experts estimate the action will sever access to more than 10 million additional compromised systems, including Android-based healthcare devices, karaoke machines, and digital signage.
Videostrong monetized the backdoor by selling access to proxy services and loading third-party malware. Google took legal action to seize the domains and servers used for command-and-control and malware distribution. The company noted that a device manufacturer intentionally infecting users represents a serious breach of trust.
The same XCPE malware was discovered in other IoT products beyond TV boxes. Google has since addressed the boot-time vulnerability that allowed immediate malware installation after first use.
Residential proxy providers linked to the botnet include AppSalt (also known as Honeygain), operated under the Oxylabs umbrella, NetNut from Alarum Technologies, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. Oxylabs later stated it suspended a supplier after discovering fake consent signals.
Synthient research connected the campaign to the earlier Kimwolf botnet and identified pre-infected MECOOL devices from Skyworth Technology that bundled the same Videostrong malware along with Grass proxy software. The report emphasizes that the 1.3 million figure is conservative and that the true scale of affected devices is likely far higher.
