[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgrb0NW8LoKbEA29HnDfch18wPrnjgmb2qeozQF3o6GE":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e491f259-e521-4168-beb1-31fe670cecee","Google disrupts million-device XCPE Android malware botnet, bans TV box maker","google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker-540fcd","Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. [...]","Google has dismantled the XCPE malware botnet, which compromised over 1.3 million Android TV streaming boxes. The botnet was allegedly intentionally infected by its manufacturer, Videostrong Technology Co., with a backdoor to facilitate cybercrime activities like ad fraud and proxy services. Google has banned Videostrong from producing certified Android devices.","Google dismantles XCPE Android malware botnet on 1.3M TV boxes, bans manufacturer.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgoogle-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F09\u002F12\u002Fandroid-tv-malware.jpg","2026-11-02T18:16:34+00:00","2026-11-02T19:00:35.441503+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"Android TV","product",{"name":21,"type":22},"Videostrong Technology Co","vendor",{"name":24,"type":25},"XCPE","threat_actor",{"name":27,"type":28},"botnet","technology",{"name":30,"type":22},"Google","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"domain","anyevonline[.]com","Command-and-control domain used by XCPE botnet.",{"type":56,"value":60,"context":61},"mqtt.szbboys[.]com","MQTT message broker domain used by XCPE botnet.",[30,21,18],{"controls":64,"vendors":141},[65,93,114],{"slug":66,"name":67,"problem":68,"products":69},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[70,77,85],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":72,"url":75,"description":76},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[98,106],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":53,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,125,133],{"vendor_slug":119,"vendor_name":30,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[142],{"slug":119,"name":30,"logo_path":120,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"manufacturer-planted-backdoor-turns-13m-android-tv-boxes-into-botnet","Manufacturer-Planted Backdoor Turns 1.3M Android TV Boxes into Botnet","The XCPE botnet case represents a deliberate supply chain attack where the device manufacturer, Videostrong Technology Co., intentionally embedded malware into Android TV streaming boxes before they reached consumers. This pre-installation of backdoors at the hardware\u002Ffirmware level means users had no practical way to detect or prevent infection through normal security hygiene. The botnet was monetized through ad fraud and proxy services, demonstrating how compromised consumer devices can be weaponized for sustained cybercrime at scale. This incident underscores that trust in a product's integrity must be established before purchase, not after deployment, and that hardware certification programs are a critical last line of defense against malicious manufacturers.",[150,151,152,153,154,155,156],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1195: Supply Chain Compromise","NIS2 Article 21(2)(b)","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 15: Service Provider Management":160,"MITRE ATT&CK T1195: Supply Chain Compromise":161,"CIS Control 13: Network Monitoring and Defense":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 requires organizations to manage supply chain security risks; procuring certified devices and auditing supplier trustworthiness are obligations this article imposes that would have mitigated this attack vector.","While the malware was intentional rather than accidental, SI-2 guidance on identifying and remediating unauthorized software in the supply chain applies directly to detecting pre-installed backdoors during device onboarding.","Videostrong was a trusted hardware supplier; rigorous third-party vetting and ongoing supplier assessment would have flagged the manufacturer's malicious intent before devices were deployed.","This incident is a textbook supply chain compromise where malware was introduced by the manufacturer prior to distribution, exactly the threat scenario T1195 describes and for which it recommends integrity verification controls.","Continuous monitoring of network traffic from IoT devices would have detected the unusual outbound behavior—ad fraud requests and proxy relaying—characteristic of the XCPE botnet's activity, enabling earlier discovery and response.","Organizations should assess vulnerability exposure across all hardware and software in use, including firmware on IoT devices, which would prompt scrutiny of uncertified or suspicious device builds.","The backdoor granted unauthorized remote access to devices; enforcing strict access control and authentication policies at the network level would have limited the botnet's ability to establish persistent command-and-control channels."]