Google has taken down a huge Android malware operation that turned over 1.3 million Android TV boxes into weapons for cyber criminals.
The company revealed that the operation was performed by Videostrong Technology, a device maker that has been accused of intentionally putting a hidden backdoor on its products and selling access to criminal affiliates.
The malware, dubbed XCPE or x.cpe, was directly embedded in the firmware of Android TV boxes sold under different brands. Google’s Threat Intelligence Group said that Videostrong developed the backdoor as a business, not letting it slip through accidentally. Criminal partners could use infected devices to generate fake ad views, reroute internet traffic through unsuspecting homes, and install more malware.
A backdoor that gives criminals control of your TV box
Google is particularly concerned about XCPE because it runs with Android system-level privileges. It connects to remote command-and-control servers, enabling attackers to silently install applications, execute shell commands, take screenshots, and collect device information.
Google also found that the malware could collect account information, application lists, and system logs. Some operators even used the ability to remotely access the devices to capture keystrokes and establish reverse shells.
Just removing the malware application isn’t enough, though. The backdoor can restore itself from a protected firmware partition on every device reboot. It can also affect Google Play Protect by changing the security settings, making it much more difficult to detect and remove.
The most common way the infection spreads is through Android TV boxes, but researchers also saw XCPE on other Android-based devices such as karaoke machines, telehealth equipment, and digital signage systems.
Google cuts off Videostrong and its criminal partners
Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to take the operation down. Its complaint targeted command servers operated by Videostrong, as well as the infrastructure behind more than a dozen other families of malware.
The company also banned Videostrong and future subsidiaries from making certified Android devices or supplying software to certified manufacturers.
The disruption could spread even further. Disabling the command infrastructure used by criminal affiliates will cut off access to at least 10 million more compromised devices infected through different distribution channels, Google figures.
Infected Android TV boxes might need replacing
There is a catch for consumers, however: the takedown does not automatically remove XCPE from impacted hardware. According to security researchers, users should identify potentially compromised devices, disconnect them, and consider replacement rather than relying on an ordinary app uninstall.
Google also tightened its firmware integrity checks and manufacturer vetting process after it found that Videostrong used obfuscation to load malicious code after a device initially booted up.