Google and industry partners dismantled the XCPE backdoor last week after it had enrolled more than 1.3 million set-top boxes into a botnet, according to a report from the Google Threat Intelligence blog.
Google assesses with high confidence that Videostrong Technology Co. intentionally developed, deployed and operated the backdoor and botnet for financial gain. The company is described as an Android original equipment manufacturer and original device manufacturer.
Videostrong allegedly monetized the infrastructure by selling access to criminal affiliates and installing those affiliates’ malware modules on compromised devices. These secondary modules were used for ad fraud, the covert enrollment of devices into residential proxy networks and the installation of additional malware on XCPE-infected set-top boxes.
Sources: LWN.net.