A botnet containing over 1.3 million Android devices, primarily TV set-top boxes, lost control of its servers in late October as a result of a Google-led takedown This article explores devices using botnet. . They captured live screenshots, manipulated keystrokes, obtained account details, device information, app lists, and system logs, and established reverse shells, which provided remote access to the device.
The actual count is likely higher.
Owners can take several steps to mitigate the risk: update their software, install security patches, and consider using additional antivirus tools. Plume, which develops Wi-Fi software for internet providers, identified over a dozen different devices using the botnet's control server, with most coming from MECOOL.
TrendAI notes that the backdoor runs as a system app signed by the manufacturer's key, so cleanup requires "vendor action, platform protection, or replacement of the device." Plume suggests a full factory reset to address potential backdoor installations on modules, but it doesn't specify if a reset will remove x.cpe. TrendAI suggests treating unmanaged consumer devices on home networks as part of the company's attack surface and keeping corporate access behind managed devices.
As of November 2, Videostrong's own website advertised products it labels as "Google Certified Android TV Box" and "Google Certified Android TV Stick." Plume claims the botnet encompassed both Google-verified devices and those running the Android Open Source Project (AOSP) version.
