Cops Bust Botnet of 1.3 Million Android TV Boxes
A coalition of security firms working with Japan's National Police Agency has disrupted a botnet of more than 1.3 million Android devices across 200+ countries. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology," the Google Threat Intelligence Group (GTIG) said in a blog post. The Register…
A joint effort by security companies and Japan's National Police Agency has dismantled a botnet comprising over 1.3 million Android devices scattered across more than 200 countries. The Google Threat Intelligence Group (GTIG) asserts with high confidence that the backdoor and botnet were deliberately created, distributed, and controlled by Videostrong Technology, a Shenzhen-based hardware manufacturer that specializes in Android devices.
Videostrong Technology incorporates the XCPE backdoor into its device firmware, subsequently selling access to criminal affiliates for them to install additional malware modules on devices purchased by unsuspecting customers. Upon connection to home networks, the pre-installed backdoor enables operators to establish proxy networks and conceal malicious traffic using the customer's internet connection, all without the customer's awareness.
The backdoor's management agent, appearing as a standard remote-management client, autonomously retrieves updates from a GitHub page and connects to a Message Queuing Telemetry Transport (MQTT) server, granting the operator complete remote control over each box. This control empowers them to install and remove applications, modify settings, and distribute updates to the infected devices.
Between June 3 and October 1, TrendAI detected more than 3.8 million unique home and mobile IP addresses connected to this operation. Additionally, the coalition disrupted the command-and-control domains used to manage affiliate modules, estimating that severing access to these domains will incapacitate at least 10 million further compromised devices.
Google has severed its relationships with Videostrong Technology, barring the OEM from manufacturing devices with preloaded Google applications.
Written by urgent.news from Slashdot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
