Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe, which at its height ran on more than 1.3 million Android TV devices. Unusually, these compromised devices were Google-certified boxes. Manufacturers must have their devices certified if they want access to Google apps and branding, a process meant to catch such threats. However, Shenzhen-based Videostrong Technology used obfuscation techniques that caused the screening process to miss the malware.
In a detailed blog post, the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Videostrong's compromised boxes, which were mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online.
After the devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious.