31
Google has severed ties with Shenzhen-based Videostrong Technology after discovering a hidden backdoor embedded in the company's Android
devices, which enrolled more than 1.3 million set-top boxes into a botnet known as XCPE.
In a report published on November 2, Google's Threat Intelligence Group said it assessed with high confidence that Videostrong had intentionally developed, deployed and operated the backdoor for financial gain. According to Google, Videostrong allegedly sold access to criminal affiliates, who used compromised devices for advertising fraud, data theft, residential proxy services and the distribution of additional malware.
Most of the affected products were Android TV set-top boxes. However, researchers also discovered the same malicious software in other Android- based Internet of Things (IoT) devices, including telehealth equipment, karaoke machines and digital signage systems.
Google said the malicious code was found across multiple brands and device models over several years, suggesting a coordinated operation rather than an isolated security incident.
The backdoor enabled attackers to communicate with infected devices and remotely execute commands. Its capabilities included silently installing applications, executing shell commands, capturing device screens and collecting sensitive information without users' knowledge or consent.
Google also found that Videostrong used techniques to conceal the malicious code and activate it after a device's first boot. This allowed the software to bypass certain existing security checks.
In response, Google took legal action to disable the domains and servers used to control the botnet and distribute additional malware. It also banned Videostrong and its affiliates from manufacturing or selling certified Android devices and supplying software to other certified vendors. Google said it had also strengthened its firmware security review process to prevent similar incidents.
The disruption involved Japan's National Police Agency and cybersecurity partners, including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google said that taking down related command-and-control domains could also cut off access to at least 10 million additional compromised devices associated with other malware operations. These devices are separate from the 1.3 million set-top boxes enrolled in the XCPE botnet.
v The incident highlights growing cybersecurity risks in the connected-device supply chain, where malicious software can be embedded directly into device firmware before products reach consumers. It also raises concerns about the security of smart televisions and other connected products that users may consider safe simply because they operate on certified Android software.
In a report published on November 2, Google's Threat Intelligence Group said it assessed with high confidence that Videostrong had intentionally developed, deployed and operated the backdoor for financial gain. According to Google, Videostrong allegedly sold access to criminal affiliates, who used compromised devices for advertising fraud, data theft, residential proxy services and the distribution of additional malware.
Most of the affected products were Android TV set-top boxes. However, researchers also discovered the same malicious software in other Android- based Internet of Things (IoT) devices, including telehealth equipment, karaoke machines and digital signage systems.
Google said the malicious code was found across multiple brands and device models over several years, suggesting a coordinated operation rather than an isolated security incident.
The backdoor enabled attackers to communicate with infected devices and remotely execute commands. Its capabilities included silently installing applications, executing shell commands, capturing device screens and collecting sensitive information without users' knowledge or consent.
Google also found that Videostrong used techniques to conceal the malicious code and activate it after a device's first boot. This allowed the software to bypass certain existing security checks.
In response, Google took legal action to disable the domains and servers used to control the botnet and distribute additional malware. It also banned Videostrong and its affiliates from manufacturing or selling certified Android devices and supplying software to other certified vendors. Google said it had also strengthened its firmware security review process to prevent similar incidents.
The disruption involved Japan's National Police Agency and cybersecurity partners, including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google said that taking down related command-and-control domains could also cut off access to at least 10 million additional compromised devices associated with other malware operations. These devices are separate from the 1.3 million set-top boxes enrolled in the XCPE botnet.
v The incident highlights growing cybersecurity risks in the connected-device supply chain, where malicious software can be embedded directly into device firmware before products reach consumers. It also raises concerns about the security of smart televisions and other connected products that users may consider safe simply because they operate on certified Android software.
