Google, alongside Japan's National Police Agency, Synthient, and Trend Micro, has dismantled the x.cpe botnet that secretly infected 1.3 million Android TV boxes. The operation targeted domains and servers operated by Videostrong, a company Google has banned from using Android apps and services due to its malware distribution. Authorities estimate Videostrong controlled approximately 10 million compromised devices across Brazil, Malaysia, Iraq, Mexico, and Taiwan, with additional infections in the US, Germany, the UK, Australia, and Canada.
While the botnet's command-and-control infrastructure has been shut down, inert malware modules remain installed as system apps on affected devices, rendering them unsafe until manually removed. Synthient has identified 182 specific device models linked to the botnet, including popular MECOOL and generic white-label Android TV boxes. Google is updating its certification process to patch the security loophole that enabled the attack, though the open-source nature of Android means uncertified devices remain vulnerable to future malicious hardware sales under different brands.
Source: Ars Technica · Summarized by HeadlinesBriefing