Google's Threat Intelligence Group (GTIG) said on Monday that, together with Japan's National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI, it disrupted the XCPE botnet: more than 1.3 million Android TV streaming boxes. Google attributes the botnet "with high confidence" to Chinese manufacturer Videostrong Technology, which it says planted a backdoor in the devices' firmware during manufacturing and sold access to criminal affiliates.
The affiliates used the devices for ad fraud, turned them into residential proxies and installed further malware. As part of the operation Google took down command-and-control servers used by more than a dozen related malware families, cutting off at least 10 million additional compromised devices, including set-top boxes, karaoke machines and telehealth hardware. Google revoked Videostrong's license to make Android TV devices with Google services, banned it and its future affiliates from producing certified Android devices, and changed its certification review after finding that the maker hid the malicious code from security testing.
What to do: according to Google, the malware has not been removed from infected devices and reinstalls itself from the system partition if deleted. Cleaning a device requires installing clean firmware, or disconnecting it from the internet.