Google dismantles x.cpe botnet that infected 1.3 million Android TV boxes
MALWAREGoogleredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
Google's Threat Intelligence Group has disrupted the x.cpe botnet, which at its height ran on over 1.3 million Google-certified Android TV devices, mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology. The botnet evolved from a single-stage dropper into a modular three-stage platform that sold access to third parties, and it used a stub app with system-level permissions to install modules while disabling Play Protect. Google also observed other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage.
For IT people · Written by AI from 2 sources · Wrong?
What to do
- Check Android TV boxes on your network for the x.cpe or com.oemservice package, especially MECOOL devices.
- Consider removing or replacing uncertified or unmanaged Android set-top boxes and similar IoT devices.
- Segment IoT and streaming devices away from sensitive internal networks.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Ars Technica (Security)The Record
Who and what is in it
Malware
Companies
Products