What happens when the malware comes from the manufacturer itself?
Google says it worked with industry partners last week to dismantle XCPE, a backdoor that enrolled more than 1.3 million set-top boxes into a botnet. Google’s Threat Intelligence Group assesses with high confidence that the backdoor was intentionally built and operated for profit by Videostrong Technology Co., an Android device maker.
How the scheme worked
According to Google, Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. Those modules ran ad fraud, quietly turned devices into residential proxies and installed additional malware. Most infected devices were Android TV boxes, but Google also saw telehealth devices, karaoke machines and digital signage.
Google says Videostrong used obfuscation to exploit a gap in its certification tests, loading malicious code after a device’s first boot.
The response
Google took legal action to seize domains and servers used to control the botnet, along with command-and-control domains for more than a dozen malware families. It estimates that will cut off access to at least 10 million additional compromised devices. Google also banned Videostrong from making certified Android devices and is tightening firmware integrity checks. BleepingComputer reports that Japan’s National Police Agency, Lumen, HUMAN Security and others took part.
The malware is not removed from devices and can reinstall itself, so owners need clean firmware or should take affected boxes offline.
Why it matters
This is hardware supply chain risk in its starkest form. A certified device from a legitimate channel can still ship compromised, and cheap IoT gear often sits on corporate networks unnoticed.
For security vendors in IoT visibility, network detection and third-party risk, it is a concrete story to open conversations with IT leaders. Buyers want practical help finding unmanaged devices before attackers use them.
Sources: Google Threat Intelligence Group, BleepingComputer, Krebs on Security. Written by the xRapid Media LLP team.
Selling to the IT market? xRapid Media LLP is a High Tech B2B Marketing company. We help technology companies reach decision-makers with verified B2B data, account-based campaigns, email and LinkedIn outreach and appointment setting. Call +91 9767196309 or book a free B2B marketing consultation.