Google has spearheaded a coordinated international operation to dismantle a massive residential proxy network built on more than 1.3 million compromised Android TV boxes. Security researchers and tech giants uncovered that the backdoor, designated XCPE, was not the result of a typical supply chain compromise or third-party hacking incident. Instead, hardware manufacturer Videostrong allegedly engineered the malware directly into the devices, actively working to conceal the malicious code from Google safety checks while secretly selling botnet access to cybercriminals.
The illicit network served multiple malicious functions, acting as a vehicle for ad fraud, a dropper for secondary malware strains, and an expansive residential proxy farm. Threat actors routinely exploit such networks to obfuscate their digital footprints, execute large-scale credential stuffing attacks, bypass geographic restrictions, and launch disruptive distributed denial-of-service operations. Because the hardware carried official Android certification, consumers purchased the streaming boxes believing they were investing in legitimate, secure electronics from a vetted provider.
To dismantle the infrastructure, Google collaborated closely with agencies and firms including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Investigators successfully seized the command-and-control domains and servers used to manage the botnet and distribute malware modules. Concurrently, Google banned Videostrong along with all associated subsidiaries and affiliates from participating in the Android ecosystem. Engineering teams also deployed enhanced firmware integrity checks to close the obfuscation gaps exploited during initial device boots.
Comments