Google and its industry partners have disrupted the XCPE malware botnet, which infected more than 1.3 million Android TV streaming devices. Google attributes the operation with high confidence to a Chinese manufacturer.
The operation also disrupted the command-and-control (C&C) infrastructure used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices, including set-top boxes, karaoke machines and telehealth hardware, not all of which ran Android.
The operation involved a persistent backdoor tracked as x.cpe and com.oemservice running with Android system-level privileges. The malware allowed attackers to remotely control infected devices, install additional applications, execute shell commands, disable Google Play Protect, capture screenshots and collect device information.
The malware communicated with C&C servers hosted on the anyevonline[.]com domain. It retrieved connection details and credentials for an MQTT message broker at mqtt.szbboys[.]com, which attackers used to send commands and distribute additional malicious modules.
The modules generated revenue through advertising fraud and residential proxy services. Infected devices were used to generate fake ad impressions, load hidden webpages and click advertisements. They were also turned into residential proxies, allowing third parties to route internet traffic through victims' devices without their knowledge or consent.
Google identified proxy-related services including Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer. Other modules installed additional backdoors, including Moyu, Spirit and Bird, to deliver additional malware.
Google linked the campaign to a Chinese OEM nad ODM manufacturer. Google revoked its license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.
Google says the company had distributed the backdoor across multiple device brands and models for years, regularly changing its architecture and configurations to avoid detection.