Google says its XCPE takedown severed bot-herders’ control of more than 10 million additional devices, beyond the 1.3 million Android set-top boxes in the botnet. The action targeted command servers used by malware modules distributed by Videostrong and its affiliates.
Videostrong gave criminal affiliates access to its device backdoor and let them load their own malware modules. Because those modules used command servers beyond XCPE’s original infrastructure, taking down those servers cut remote control across a much wider set of devices. It did not remove XCPE’s backdoor from infected hardware: the implant sits in a protected partition and reinstalls after reboot.
For organizations with XCPE-infected boxes, the backdoor remains even though operators lost command access. The reporting does not establish whether the additional devices retain implants, leaving the scale of residual compromise beyond the original botnet unclear.
Google dismantles massive botnet hidden in Android TV boxes
The overwhelming majority of the infected devices in the X.CPE botnet are Android TV set-top boxes, Google said, adding that they observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices.