Google and industry partners dismantled the XCPE backdoor last week, cutting into a botnet that had enrolled more than 1.3 million set-top boxes. The move also targeted the command and control domains behind affiliate malware modules, in a disruption Google says will sever access to at least 10 million additional compromised devices.
That scale is why this matters now. Google said the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer and Original Design Manufacturer that used the access to sell to criminal affiliates and load their malware onto infected devices. The result was not just one infected network, but a wider pipeline for ad-fraud, residential proxy activity and more malware.
Google found the malicious software built directly into many different device models and brands over multiple years, showing how long the XCPE backdoor could stay buried inside ordinary hardware. The company said Videostrong supported the operation with dedicated infrastructure and constantly changing configurations designed to evade detection and keep affiliates supplied.
The part that complicates the cleanest reading of the case is how the code got in. Google said Videostrong used obfuscation techniques to exploit a gap in the company’s compatibility and security tests, loading malicious code after first boot even as OEMs are supposed to pass a comprehensive review process before shipping devices with preloaded Google apps. In response, Google cut ties with Videostrong, banned it from making devices with preloaded Google apps, and changed its review process to harden the checks going forward.
Google also worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, and pursued legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules. That effort included C2 domains tied to over a dozen malware families loaded through the backdoor, underscoring that the takedown was aimed at an operating system for abuse, not a single strain of malware. The next question is how much of that ecosystem survives now that the core infrastructure has been cut off.
