Google Dismantles Massive Android TV Botnet

Google's Threat Intelligence Group recently announced the takedown of a vast botnet, dubbed x.cpe, that compromised over 1.3 million Google-certified Android TV devices. The campaign, orchestrated by Shenzhen-based Videostrong Technology, exploited vulnerabilities in the certification process using obfuscation and a backdoor. This allowed malware to be installed remotely after devices were online, bypassing Google's Play Protect.

Compromised devices were primarily used for residential proxies or ad fraud schemes. Videostrong also maintained full device access, enabling real-time command execution and screen capture. Google collaborated with international law enforcement and cybersecurity firms to disrupt the network, shut down command and control servers, and cut off access to approximately 10 million compromised devices globally.

While the takedown makes affected devices safer, Play Protect remains disabled and malware modules are difficult to remove. Google has terminated its relationship with Videostrong and is enhancing its device certification procedures. Trend Micro identified nearly 1.5 million infected devices, with significant concentrations in Brazil, Malaysia, Iraq, Mexico, and Taiwan, as well as tens of thousands in the US, Germany, UK, Australia, and Canada.