Google Dismantles 1.3M-Device Botnet from Infected TV Boxes — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Google worked with industry partners to dismantle the XCPE botnet, which hijacked over 1.3 million Android TV set-top boxes to resell users’ internet connections as residential proxies.
- Videostrong Technology Co. was identified as the manufacturer behind the malware-laden TV boxes, with Google severing ties and taking legal action to shut down its command-and-control infrastructure.
- Synthient found that the same XCPE malware was bundled in devices like MECOOL TV boxes from Skyworth Technology, which also installed proxy software including AppSalt/Honeygain and Grass.
- Residential proxy providers AppSalt (Honeygain), NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode were linked to the botnet through their SDKs being downloaded by infected devices.
- The GTIG report estimates the takedown will cut off access to at least 10 million additional compromised IoT devices, including telehealth units, karaoke machines, and digital signage systems.
- Synthient’s Brundage called the 1.3 million figure 'highly conservative,' suggesting the true scale of affected devices is significantly larger than current estimates.
Why it matters: Over 10 million IoT devices likely lose illicit proxy access, disrupting ad fraud and cybercrime operations that relied on residential IP addresses. Device makers like Videostrong and Skyworth face reputational and legal risk, while proxy services tied to the botnet may see enforcement scrutiny despite some claiming legitimate use cases.
Ask SkimNews
