Google and Partners Dismantle XCPE Botnet Using 1.3M Android TV Boxes

Google and industry partners have dismantled a massive botnet, dubbed “XCPE,” which comprised more than 1.3 million Android TV set-top boxes. The malware turned these devices into residential proxies, allowing criminals to rent users’ internet connections to conduct advertising fraud and other illicit activities.

The Google Threat Intelligence Group (GTIG) identified Videostrong Technology Co., a Chinese TV box manufacturer, as being responsible for including the malicious software. The malware was reportedly loaded onto devices immediately after a user’s first boot-up, bypassing standard security checks.

Widespread Impact on IoT Devices

While TV boxes formed the majority of the botnet, experts believe the takedown will also sever access to more than 10 million additional compromised systems. These include various Internet of Things (IoT) products, such as Android-based healthcare devices, karaoke machines, and digital signage systems.

The XCPE botnet made users’ internet addresses available for resale through multiple residential proxy services. These services are frequently used by bad actors to anonymise web traffic, spoof locations, and carry out account takeover activities or mass content scraping for AI projects.

Links to Proxy Providers

The GTIG report named several residential proxy providers whose software development kits (SDKs) were routinely downloaded by infected devices. Providers linked to the botnet include AppSalt (operating as Honeygain), NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, and GaGaNode.

Cybersecurity startup Synthient also investigated the spread of the malware, finding that popular brands such as MECOOL, produced by Skyworth Technology, also bundled the malicious software. Synthient founder Ben Brundage suggested the 1.3 million figure is a conservative estimate and described it as one of the largest operations against backdoored TV boxes observed to date.

Google has stated that it has since addressed the security weakness that allowed the malware to load post-boot. Users of Android-based set-top boxes and similar IoT devices are encouraged to monitor their network traffic for suspicious activity.