Google Takes Action Against Chinese Device Maker Linked to Massive Botnet Operations
In a significant move to combat cybercrime, Google has publicly announced the ban of a Chinese Android device manufacturer known as Videostrong Technology, and it has also collaborated with various partners to dismantle a substantial botnet. This botnet, identified as XCPE, has reportedly included over 1.3 million compromised set-top boxes. This revelation, detailed in a blog post by the Google Threat Intelligence Group (GTIG) on November 2, underscores the serious nature of the threats posed by malicious cybersecurity activities.
The GTIG conveyed a strong message in its assessment, asserting its confidence that Videostrong was effectively responsible for both the creation of the XCPE botnet and the backdoor vulnerabilities associated with it. The findings indicated that Videostrong was not just a passive actor but was actively monetizing the backdoor by offering access to criminal affiliates. These affiliates, in turn, were deploying various malware modules onto the infected devices, which resulted in a series of illicit activities.
According to Google’s detailed explanation, the XCPE botnet was more than a mere operational nuisance. It had evolved into a sophisticated network of compromised devices that facilitated numerous forms of cyber fraud. The secondary malware modules resulting from these operations were found to conduct ad fraud, quietly enroll infected devices into residential proxy networks, and load extra, damaging malware onto devices compromised by XCPE.
In an extensive operational sweep against cybercriminal networks, Google’s industry efforts not only targeted the botnet itself but also significantly disrupted command-and-control (C2) servers crucial for the operations of Videostrong’s criminal affiliates. This collective action led to the disconnection of more than 10 million compromised devices from the control of these cybercriminals, effectively hindering their operations.
The blog further emphasized the complexity and sophistication of the malicious software that was embedded within a variety of device models and brands over the years. The infrastructure backing this malware was not a mere fluke; it revealed dedicated resources committed to continuously evolving and evading detection. Google concluded that this campaign was not an isolated incident rooted in a single rogue actor but a systemic issue implicating the entire hardware supply chain. As a result of these findings, Google has severed its business relationship with Videostrong and banned the company from manufacturing devices equipped with preloaded Google applications.
The XCPE botnet’s reach extended beyond set-top boxes, with its influence penetrating into the realms of telehealth devices, karaoke machines, and even digital signage equipment. Google elaborated on how Videostrong had embedded the XCPE backdoor into the firmware of devices, enabling its functionality at the android.uid.system privilege level. This backdoor automatically reinstalls itself from the /oem/ partition upon reboot, making it exceedingly difficult for users to remove it without specific know-how.
Upon startup, the compromised devices would automatically connect to a C2 server, utilizing an MQTT message broker to receive commands. This setup allowed the affiliates to conduct malicious actions remotely. Attackers could execute shell scripts, disable crucial protective measures like Google Play Protect, and silently install additional applications without the user’s consent.
Moreover, the monetization strategy employed by Videostrong revealed a troubling nexus between their operations and other cybercrime enablers. Malware modules originating from various operators involved in residential proxy services were being installed onto the compromised devices. Notable among these were well-known services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, all of which are notorious for facilitating a range of cybercrimes—including account takeovers, payment fraud, ad-click fraud, web scraping, and DDoS attacks.
In the concluding remarks of the blog post, Google acknowledged the ongoing challenge in combating these activities. While they believed their recent actions had substantially impacted over a dozen malicious operations, the underlying illicit market remains remarkably resilient. The interconnected nature of backdoor operators, ad-fraud networks, and residential proxy providers suggests that disrupting one area often leads to rapid adaptation by the remaining players. Google emphasized that creating lasting change necessitates greater accountability across the entire hardware supply chain, the residential proxy industry, and the broader technology ecosystem.
The situation sheds light on the urgent need for improved security measures and vigilance throughout the tech industry to combat cyber threats that pose risks not only to individuals but also to organizations on a global scale.