Google, several cybersecurity companies and Japanese law enforcement dismantled a global botnet called X.CPE, according to the source. The botnet was hidden in more than 1.3 million set-top boxes across more than 200 countries.
Google said it tied the scheme to Videostrong Technology, a Chinese company that was an Android original equipment manufacturer. Google and other investigators accused Videostrong of monetizing the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. Google said Videostrong was allegedly turning infected devices into a residential proxy network.
Google also observed other infected Android-based devices, including telehealth devices, karaoke machines and digital signage devices. Google said X.CPE was embedded in device firmware before the devices reached customers. Google has cut ties with Videostrong and banned it from making devices with preloaded Google apps.
Google worked with Japanese police and the cybersecurity firms TrendAI, Human and Synthient to disrupt the domains that underpinned the botnet. Robert McArdle, director of cybercrime research at TrendAI, said his research identified over 1.3 million affected devices.
Videostrong did not respond to requests for comment.