Post Syndicated from corbet original https://lwn.net/Articles/1104847/

The Google Threat Intelligence blog describes,
in great detail, the XCPE botnet, which has just been taken down.

Last week, Google and industry partners dismantled the XCPE
backdoor which enrolled more than 1.3 million set-top boxes into a
botnet. We assess with high confidence that the backdoor and botnet
were intentionally developed, deployed, and operated for financial
gain by Videostrong Technology Co., an Android Original Equipment
Manufacturer (OEM) and Original Device Manufacturer (ODM).

Videostrong monetized the backdoor by selling access to criminal
affiliates and loading those affiliates’ malware modules onto
infected devices. These secondary modules were conducting ad-fraud;
silently enrolling infected devices into residential proxy
networks; and loading additional malware onto XCPE-compromised
devices.