Shutting the Door on the XCPE Botnet

Google and partners including Japan's National Police Agency, Lumen, HUMAN Security and TrendAI dismantled XCPE, a firmware backdoor that enrolled over 1.3 million mostly Android TV boxes. Google's threat intelligence group assesses with high confidence that OEM Videostrong built and ran it for profit, selling access to proxy and ad-fraud affiliates. Google says the firm loaded code after first boot to evade certification tests, and it has banned Videostrong and revised its firmware review. These are Google's own assessments.