Overview
- Google disclosed Monday that it led a legal and technical operation that severed the command‑and‑control infrastructure for XCPE, a botnet made up of more than 1.3 million Android devices.
- Google’s Threat Intelligence Group says it has high confidence that Videostrong, an OEM/ODM in Shenzhen, intentionally built the persistent backdoor and sold access to criminal affiliates.
- The backdoor, tracked as x.cpe or com.oemservice, runs with Android system privileges, can disable Play Protect, install apps silently, capture screenshots and run shell commands, and automatically reinstalls from a protected /oem partition on reboot.
- Because the malware is embedded in signed firmware, removal typically needs a clean firmware image from the vendor or platform intervention, so researchers advise disconnecting suspected boxes or replacing them to stop ongoing abuse.
- Google banned Videostrong from Android certification, disrupted C2 domains used by over a dozen malware families, and worked with partners including Japan’s National Police Agency, Lumen, Plume, Synthient and TrendAI while warning that the proxy/ad‑fraud market may quickly pivot to new loaders.