Minacce · 5 ore fa
Google ha smantellato XCPE, una botnet presente su oltre 1,3 milioni di dispositivi Android, e riferisce di aver interrotto il controllo criminale su più di 10 milioni di altri dispositivi. Il raggio dell’operazione supera quindi quello dei set-top box infettati direttamente da XCPE.
Videostrong Technology aveva dato accesso alla backdoor a criminali affiliati, che caricavano moduli malware con propri server di comando. Colpendo l’infrastruttura condivisa di questi moduli, Google ha interrotto il controllo remoto su dispositivi anche al di fuori della botnet XCPE.
La disconnessione non dimostra che i dispositivi siano stati ripuliti: la backdoor XCPE resta sui dispositivi infetti e può reinstallarsi al riavvio. Per le organizzazioni con set-top box e dispositivi IoT basati su Android, il controllo criminale interrotto non equivale al ripristino dell’integrità.
11 fonti che coprono questa storia
The Record from Recorded Future
Google dismantles massive botnet hidden in Android TV boxes
The overwhelming majority of the infected devices in the X.CPE botnet are Android TV set-top boxes, Google said, adding that they observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices.
Google dismantles botnet secretly running on 1.3 million Android TV boxes
Google has cut ties with the company behind the botnet campaign.
Police and Tech Firms Team Up to Dismantle XCPE Botnet
Google and partners have taken down the XCPE botnet attributed to Chinese device maker Videostrong
Google Dismantles XCPE Botnet of 1.3 Million Android Devices
The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology.
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud.
Google shuts down global botnet running on certified Android devices
Videostrong sold TV set-top boxes and other devices with pre-installed malware.
Cops bust botnet of 1.3M infected Android TV boxes
Videostrong accused of shipping devices with a backdoor baked in
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities.
Google disrupts XCPE botnet, bans the company behind it - Help Net Security
Google disrupted the XCPE botnet, a backdoor built into the firmware of more than 1.3 million Android TV set-top boxes by their maker.
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
Google disrupts the x.cpe botnet on over 1.3 million Android devices, linking the firmware backdoor to manufacturer Videostrong.
Shutting the Door on the XCPE Botnet | Google Cloud Blog
Google and industry partners have dismantled the XCPE backdoor and botnet, which was intentionally developed and operated by OEM Videostrong Technology Co.
Part of the PlainSec briefing for 2026-11-03