Chinese company Videostrong Technology is accused of infecting Android TV boxes with malicious software. As a result of this activity, about 1.3 million devices, including popular models such as the Mecool KM2, KM2 Plus, KM6, KM7, KM9 Pro, became part of the XCPE botnet.
How the devices were compromised
The malware was embedded directly at the firmware level at the manufacturing facility. According to Google, the company not only distributed such infected devices but also sold access to them to other cybercriminals.
Monetization mechanism and threats
Experts believe the botnet was deliberately designed and operated for financial gain. Videostrong monetized this backdoor by selling access to criminal accomplices. These accomplices, in turn, loaded malware modules onto the infected devices that were used for ad fraud, covertly connecting them to residential proxy networks, and downloading additional malware.
Countermeasures
Last week, Google and industry partners were able to dismantle the XCPE backdoor, which had integrated more than 1.3 million set-top boxes into a botnet. In addition, action was taken to disrupt the command-and-control (C2) domains that were used to manage these modules.
