Google's Threat Intelligence Group shut down a botnet called x.cpe that infected more than 1.3 million Android TV devices, most sold under the MECOOL brand by Shenzhen-based Videostrong Technology. The devices were Google-certified, but the malware used obfuscation techniques to evade screening during certification.
The botnet operated in three stages. A stub application called x.cpe or com.oemservice installed on certified devices and phoned home after going online. This application had system-level permissions to install malware modules and disabled Play Protect, Google's security tool. Once active, the malware ran residential proxies to route traffic or executed ad fraud schemes.
Videostrong retained full access to the infected boxes, allowing operators to run terminal commands, capture screens, and probe other devices on local networks. Google observed Videostrong doing this in real time. The malware installed silently after devices were online, bypassing Google's certification process that only checked devices before shipment.
Google worked with Japan's National Police Agency, Synthient, and Trend Micro to disrupt the operation. Google shut down Videostrong's domains, servers, and command-and-control infrastructure connected to other malware campaigns. Google estimates the action cut Videostrong off from about 10 million compromised devices. Trend Micro counted 1,472,554 infected devices total, with most in Brazil, Malaysia, Iraq, Mexico, and Taiwan. Tens of thousands were also in the US, Germany, the UK, Australia, and Canada.
Google ended its relationship with Videostrong and barred the company and its subsidiaries from using Google's Android apps and services. Synthient published a list of 182 device model names known to be included in the botnet. Google said it is updating its certification process to close the loophole Videostrong exploited.