Google has managed to neutralize the infrastructure of XCPE, a botnet that controlled over 1.3 million Android-based devices globally.
The threat primarily affected media players and TV set-top boxes (Android TV set-top boxes), although cybersecurity analysts also detected the presence of this code in karaoke consoles, telemedicine terminals, and advertising screens.
The most striking aspect is that this time the malicious code was not introduced through everyday use or app downloads, but was integrated into the devices’ operating system (firmware).
Google’s Threat Intelligence team has linked this network to the hardware manufacturer Videostrong Technology. The Chinese company used this mechanism to monetize the devices after their sale, renting access to the infected network to third parties.
The software allowed the terminals to be transformed into nodes for unauthorized residential proxy networks, perform ad click fraud in the background, and execute espionage functions such as live screen capture, keystroke logging, and system metadata collection.
A threat that rose like the Phoenix
The malware stands out for its persistence within the equipment. Since it was part of the system package and located in the partition, it could survive a factory reset. Thus, even if the user tried to format the device, the backdoor would automatically reinstall during the boot process.
Additionally, to evade traditional detection systems, the system downloaded secondary components from repositories hosted on GitHub.
As a result of this threat, the Mountain View company has decided to revoke official Android certifications from Videostrong and its associated brands. The tech giant didn’t hesitate to also block their ability to market new devices with its operating system license.
“Our priority is to protect the integrity of the Android ecosystem and ensure that users can trust the security of their devices from the moment they connect them,” highlighted the Google division.
Google has managed to neutralize the infrastructure of XCPE, a botnet that controlled over 1.3 million Android-based devices globally.
The threat primarily affected media players and TV set-top boxes (Android TV set-top boxes), although cybersecurity analysts also detected the presence of this code in karaoke consoles, telemedicine terminals, and advertising screens.
The most striking aspect is that this time the malicious code was not introduced through everyday use or app downloads, but was integrated into the devices’ operating system (firmware).
Google’s Threat Intelligence team has linked this network to the hardware manufacturer Videostrong Technology. The Chinese company used this mechanism to monetize the devices after their sale, renting access to the infected network to third parties.
The software allowed the terminals to be transformed into nodes for unauthorized residential proxy networks, perform ad click fraud in the background, and execute espionage functions such as live screen capture, keystroke logging, and system metadata collection.
A threat that rose like the Phoenix
The malware stands out for its persistence within the equipment. Since it was part of the system package and located in the partition, it could survive a factory reset. Thus, even if the user tried to format the device, the backdoor would automatically reinstall during the boot process.
Additionally, to evade traditional detection systems, the system downloaded secondary components from repositories hosted on GitHub.
As a result of this threat, the Mountain View company has decided to revoke official Android certifications from Videostrong and its associated brands. The tech giant didn’t hesitate to also block their ability to market new devices with its operating system license.
“Our priority is to protect the integrity of the Android ecosystem and ensure that users can trust the security of their devices from the moment they connect them,” highlighted the Google division.
Become a premium member for free!
——————————————————-
Click Here For The Original Source.
