Google, part of Alphabet Inc. (NASDAQ: GOOGL), said it helped dismantle the XCPE botnet, a campaign that embedded a backdoor in Android-based device firmware and used it to load malware modules, route traffic and run remote commands. The investigation matters to security teams responsible for connected endpoints because Google found the malware on more than just streaming boxes, including digital signage and telehealth devices.
Google Threat Intelligence said the campaign enrolled more than 1.3 million set-top boxes and that its actions against related command-and-control domains could cut access to at least 10 million additional compromised devices used by affiliated malware operators. Google worked with Japan’s National Police Agency and several security companies on the disruption, according to the company.
The core component, called x.cpe, was preloaded in the firmware partition and operated with Android system privileges. Google said that design made the malware persistent: if a user removed it from the application directory, the device could reinstall it after a reboot from the OEM partition. The company said it has changed its review process for certified Android TV devices after identifying techniques that allowed malicious code to load after first boot.
For enterprise endpoint and network teams, the report illustrates a supply-chain problem that conventional application controls can miss. A device can enter an environment with the malicious component already below the layer normally managed through app inventories, user permissions or routine mobile-device-management policies. Google described infected Android-based IoT devices beyond set-top boxes, so facilities, healthcare and retail operators may need to account for device provenance as well as patch and configuration status.
The malware used a two-stage command-and-control design. It first retrieved configuration data over HTTP, then maintained a persistent MQTT connection to receive instructions. Google said the operators used that channel for silent application installation, shell commands, screen capture, network reconnaissance and delivery of additional modules. Some later payloads were designed to obtain root access, remount the system partition and grant themselves installation and reboot permissions.
Google also described a modular business model behind the operation. The backdoor could install residential-proxy, bandwidth-sharing, ad-fraud and additional backdoor components from operator-controlled infrastructure and third-party hosting services. The company said that upstream operators could activate or disable modules through configuration messages and manage the infected devices in regional pools.
The response combined domain and server takedowns with a ban on Videostrong and future affiliates from making or supplying certified Android devices. Google said it also took action against command-and-control domains used by more than a dozen malware families associated with the operation. Those actions can disrupt an active campaign, but the company cautioned that backdoor operators and proxy networks can pivot to new loaders or services.
The practical issue for IT organizations is that managed connected devices need a security review before deployment, not only after suspicious activity appears. Google urged hardware brands, distributors and other technology providers to use independent security audits and share intelligence on malicious backdoors. The XCPE botnet disruption shows why endpoint programs that rely only on post-deployment software controls may have limited visibility when compromise begins in firmware.