Shutting the Door on the XCPE Botnet (Threat Intelligence)

The Google Threat Intelligence blog describes,in great detail, the XCPE botnet, which has just been taken down.

Last week, Google and industry partners dismantled the XCPEbackdoor which enrolled more than 1.3 million set-top boxes into abotnet. We assess with high confidence that the backdoor and botnetwere intentionally developed, deployed, and operated for financialgain by Videostrong Technology Co., an Android Original EquipmentManufacturer (OEM) and Original Device Manufacturer (ODM).

Videostrong monetized the backdoor by selling access to criminalaffiliates and loading those affiliates' malware modules ontoinfected devices. These secondary modules were conducting ad-fraud;silently enrolling infected devices into residential proxynetworks; and loading additional malware onto XCPE-compromiseddevices.