Cybersecurity: Google Takes Down Global Android Botnet

Google, Japanese police and five companies detected, exposed and shut down a global botnet, according to an invidis report. Partners included Lumen, Synthient and Trend AI.

The network, called XCPE, comprised more than 1.3 million Android devices. Besides TV boxes, digital signage devices were also infected.

Google blames Shenzhen-based manufacturer Videostrong. The company allegedly built a backdoor, a hidden remote access point, into its own firmware. Videostrong sold that access to criminals. They routed third-party traffic through the devices’ internet connections and faked ad views. Videostrong is now banned from building certified Android devices.

Trend AI counted about 1.47 million infected devices from June to early October, mostly in Malaysia, Brazil, Iraq, Mexico and Taiwan; Germany, the U.S., the U.K., Australia and Canada each had roughly 26,000 to 42,000. Actual numbers are likely higher.

Network operators and integrators using low-cost Android boxes or white-label hardware should check first. Android certification alone is not sufficient proof. Partner Plume says the backdoor also hit certified devices. Synthient found it on Mecool-branded boxes and published 182 suspicious model names. A model name alone does not prove infection. Operators can search their firewall logs for the domains and IP addresses listed in Google’s report.

The command servers are offline, but the backdoor remains in the firmware. If deleted, it reinstalls itself on reboot. Only action by the manufacturer or platform, or replacing the devices, will help; partners advise taking suspicious devices offline. Retailers and distributors should require independent security audits from contract manufacturers.