Google dismantles 1.3 million-device XCPE Android botnet, bans TV box maker

· Cybersecurity

Google and industry partners dismantled the XCPE malware botnet, which consisted of more than 1.3 million infected devices, most of them Android TV set-top boxes. Google said the botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology, which it says intentionally infected devices with malware to generate revenue through cybercrime, and it banned the manufacturer. Investigators also found other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage. The takedown highlights the risk that low-cost, internet-connected consumer hardware shipped with preinstalled malware can be conscripted into large-scale criminal infrastructure, a concern for buyers of cheap devices and for the IoT supply chain.

Why it matters：The takedown shows preinstalled malware in cheap consumer hardware can scale into a million-device criminal network, sharpening scrutiny of device manufacturers and IoT supply-chain assurance.

Key points

  • Most infected devices were Android TV set-top boxes from manufacturer Videostrong Technology.
  • Google said the botnet was run for financial gain and banned the maker.
  • Telehealth devices, karaoke machines and digital signage were also infected.

Sources (original reporting)

More stories from this day