Google Says Videostrong Backdoor Powered Botnet That Enrolled More Than 1.3 Million Boxes

Google and its industry and law-enforcement partners disrupted the control systems for an XCPE botnet that enrolled more than 1.3 million set-top boxes, while leaving its firmware implant on affected devices.

The control systems managed the botnet remotely. Disrupting them did not remove the implant already embedded in affected devices’ firmware.

Google assessed with high confidence that Shenzhen-based Videostrong Technology Co. developed and operated the backdoor for financial gain, then sold criminal affiliates access to infected devices. Modules enabled ad fraud, residential proxy use — routing traffic through household internet connections — and the installation of additional malware.

Monitoring recorded 1,472,554 infected devices across 206 models. Because collection was intermittent, that device count was a lower bound.

From June 3 to Oct. 1, monitoring recorded 3,849,226 distinct residential exit IP addresses, with an average of 182,025 available on a single day and a peak of 366,562. Those figures count IP addresses, not infected devices. Observed device counts in each of the United States, Germany, the United Kingdom, Australia and Canada ranged from about 26,000 to 42,000.

The implant appeared in multiple device models and brands over several years. Most affected devices were Android TV boxes; telehealth devices, karaoke machines and digital signage were also affected. Obfuscation let malicious code load after devices’ first boot, exploiting a gap in Google’s review process. Google has since changed that process.

Google used legal action to take down Videostrong’s control domains and servers, as well as command-and-control domains used by more than a dozen malware families. It also barred Videostrong and future subsidiaries or affiliates from building or selling certified Android devices or supplying software to other certified vendors.

Google estimated that disrupting affiliate command-and-control domains would cut access to at least 10 million additional compromised devices. That is an estimate of expected impact, not a confirmed count of devices affected after the disruption.

“Operations like this raise the cost for criminals and show that the infrastructure they rely on isn't out of reach,” said Charley Snyder, head of disruption operations at Google Threat Intelligence Group.