Shutting the Door on the XCPE Botnet (Threat Intelligence)

The Google Threat Intelligence blog describes, in great detail , the XCPE botnet, which has just been taken down. Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Device Manufacturer (ODM). Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affil