Google Dismantles 1.3 Million-Device Android Botnet, Links TV Box Maker to Backdoor

Google has successfully dismantled a sprawling Android botnet that compromised over 1.3 million devices, predominantly Android TV set-top boxes. The operation, which concluded in late October, saw the disruption of the botnet's command-and-control (C2) infrastructure. Google's investigation strongly suggests that Videostrong, a Shenzhen-based manufacturer of Android TV boxes and other devices, intentionally built a backdoor into its products, which was then allegedly sold to criminal actors.

The backdoor, identified as 'x.cpe,' operated with system-level privileges as a pre-installed system app within the device firmware. This allowed the botnet operators to remotely control the compromised devices, including disabling Google Play Protect's app verification to silently install malicious software. Google's analysis revealed that operators used these capabilities to capture screenshots, log keystrokes, exfiltrate account and device information, and establish reverse shells for direct command-line access.

Criminals leveraged the compromised devices primarily for two illicit activities: ad fraud and the operation of residential proxy networks. In the former, they faked views of online advertisements to generate fraudulent revenue. For proxy services, they sold access to the owners' home internet connections, making malicious traffic appear to originate from legitimate households. While most affected devices were TV boxes, the backdoor was also found on telehealth devices, karaoke machines, and digital signage.

TrendAI, a unit of Trend Micro, identified nearly 1.5 million infected devices across 206 models between June and October, with Malaysia, Brazil, and Iraq reporting the highest numbers. Google has taken legal action to seize the domains and servers controlling the botnet and associated malware families. This action is expected to cut off access to at least an additional 10 million infected devices that were also targeted by the same malware operators through other distribution methods.

Google has severed all ties with Videostrong, banning the company and its affiliates from producing or selling certified Android devices and from supplying software to other certified device makers. This move comes after Google discovered that Videostrong allegedly circumvented compatibility and security tests by hiding its malicious code, which was loaded after the device's initial boot. Google is reportedly enhancing its firmware review processes for certified Android TV devices.

Unfortunately, the x.cpe backdoor is deeply embedded in the firmware and cannot be easily removed by users, often reinstalling itself after a device restart. Security researchers recommend that owners of potentially affected devices, particularly MECOOL-branded boxes linked to Videostrong, should consider discarding them due to the persistent risk of malware infection. Organizations are advised to isolate such devices and block known command-and-control infrastructure.

While Google's takedown significantly disrupted the botnet's operations, the company warns that the operators and their clients are agile and will likely pivot to new tools and infrastructure. The ongoing threat underscores the importance of supply chain security and robust device vetting processes in the Android ecosystem, especially for Internet of Things (IoT) devices that often lack regular security updates.