CriticalAPT
Shutting the Door on the XCPE Botnet
Google Cloud Threat Intel (Mandiant)·Source published ·1 min read
What happened?
Introduction Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Device Manufacturer (ODM). Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices.
Key details
- Google and partners dismantled the XCPE backdoor that enrolled over 1.3 million set-top boxes into a botnet.
- Videostrong Technology Co. intentionally developed and operated the backdoor for financial gain by selling access to criminal affiliates.
- Infected devices were used for ad-fraud, residential proxy networks, and loading additional malware modules.
- Disruption of affiliate C2 domains is expected to sever access to at least 10 million additional compromised devices.
Affected
- Multiple device models and brands over multiple years with pre-installed malicious software.
Fixes and mitigations
- Legal action to take down Videostrong C2 domains and servers.
What to look for
- Monetization modules: Linkfog, AppSalt, NetNut, CBOXTV, HiddenView, Moyu, Spirit.
- MQTT topic structure: /device/{model}/{chipId}/{action}.
- Malware staging via GitHub releases on operator-owned GitHub pages.
Summarised by SecOraLens from Google Cloud Threat Intel (Mandiant). Always read the original source before acting. How SecOraLens verifies advisories.