Google Threat Intelligence disrupts the XCPE botnet

Google and industry partners say they have dismantled the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet. Google assesses with high confidence that the backdoor was intentionally built, deployed and operated for financial gain by Videostrong Technology Co., an Android device manufacturer, which allegedly sold criminal affiliates access to infected devices and loaded their malware modules onto them. Those secondary modules reportedly ran ad fraud schemes, silently enrolled devices into residential proxy networks, and loaded additional malware.

Google also took action against the command and control domains used by those affiliate modules, and because the affiliates have other distribution channels beyond XCPE, Google estimates this could sever access to at least 10 million additional compromised devices. As a result, Google has cut ties with Videostrong and banned the company from making devices with preloaded Google apps, and has updated its review process to guard against similar activity.

Technically, the backdoor was preloaded in device firmware, reinstalled itself if removed, and communicated with command and control servers over HTTP and a persistent MQTT connection, and was capable of silent app installs, disabling Google Play Protect, arbitrary shell execution, screen capture and keystroke injection, and network reconnaissance. Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the investigation and disruption.

Why it matters

It is a reminder that hardware supply chain compromise, built in by a manufacturer rather than an outside hacker, can quietly turn millions of consumer devices into a criminal infrastructure.

Source: Google Cloud Threat Intelligence