Google Disrupts XCPE Botnet Linked to Videostrong

Google says it used legal action to disrupt the control infrastructure of the XCPE botnet, which it links to Chinese device maker Videostrong Technology. The operation targeted domains and servers controlling the botnet and more than a dozen malware families distributed through its backdoor. Google said the action was expected to cut access to at least 10 million additional compromised devices. The botnet affected more than 1.3 million Android devices, most of them TV set-top boxes, according to Google. TrendAI separately counted 1,472,554 infected devices across 206 models between June 3 and October 1, and said that total was a minimum. The devices were spread across more than 170 countries, according to TrendAI researchers cited by Google. Google’s Threat Intelligence Group assessed with high confidence that Videostrong deliberately installed the x.cpe backdoor in devices and sold criminal groups access to them. Google said it did not believe the campaign resulted from a rogue insider or a development oversight. The attribution is Google’s assessment; the company did not publicly specify when or how it first learned of the activity. The firmware-based backdoor could download...