Devices Are Also Sold in Türkiye! 1.3 Million Android Devices Turned into a Botnet

Google has cut ties with a manufacturer responsible for turning more than 1.3 million Android devices into a botnet. More than 30,000 devices in Türkiye were affected by the attack, which also targeted users' personal data.

Google announced that China-based Videostrong Technology had secretly turned more than 1.3 million Android devices into a botnet. During an operation carried out in late October, the malware's command-and-control servers were taken offline. Google also terminated its relationship with the manufacturer and banned the company from producing certified Android devices.

A Hidden Backdoor Was Installed in Android TV Boxes

According to Google's investigation, Videostrong had embedded a backdoor called x.cpe into the firmware of various device brands and models over several years. Google stated that the company intentionally developed and distributed the malware for financial gain.

The backdoor activates after the device's initial startup and can disable Google Play Protect's application security checks. Operating as a system application with elevated privileges, x.cpe receives instructions from command-and-control (C2) servers, allowing attackers to install applications, execute commands, capture screenshots, and map the connected network without users' knowledge.

Google reported that Videostrong operators used these capabilities to capture live screenshots, record keystrokes, and extract account credentials, device information, application lists, and system logs.

Videostrong allegedly sold access to compromised devices to criminal partners, who installed additional malware modules. As a result, infected devices were incorporated into residential proxy networks that exploited users' home internet connections.

Although the botnet primarily consisted of Android TV set-top boxes, telehealth devices, karaoke machines, and digital advertising displays were also affected.

Tens of Thousands of Devices Affected in Türkiye

According to TrendAI's investigation conducted between June 3 and October 1, a total of 1,472,554 infected devices across 206 models were identified. The organization noted that the actual number could be higher.

The countries with the highest numbers of infected devices were Malaysia, Brazil, Iraq, Mexico, and Taiwan.

In Türkiye, 32,532 devices were identified as affected, placing the country 11th worldwide.

Google Shut Down the Command-and-Control Servers

Google used legal measures to disable the domains and servers controlling the botnet. It also took down the command-and-control domains associated with more than a dozen malware families distributed through the backdoor.

The operation was supported by Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

Google estimates that the intervention could prevent attackers from accessing at least 10 million additional infected devices, as the malware families involved also use other distribution channels.

However, the operation did not remove the backdoor from affected devices. Because x.cpe is embedded directly into the device firmware, it may reinstall itself after a restart.

What Should Device Owners Do?

Synthient published a list of 182 potentially affected device models. However, the organization warns that a matching model name does not necessarily mean a device is infected.

Researchers have particularly highlighted MECOOL devices, which are also widely sold in Türkiye.

Experts recommend resetting potentially affected devices to factory settings as a minimum precaution. However, a factory reset may not remove the x.cpe backdoor.

TrendAI explains that the malware operates as a system application signed with the manufacturer's key, meaning complete remediation may require manufacturer intervention, platform-level protection, or device replacement.

Synthient advises consumers to stop using affected devices.

Some of the Measures We Should Take to Protect Against Such Attacks Include;

• Purchasing Android TV boxes and other smart devices from trusted, certified manufacturers.

• Regularly checking for firmware updates and security patches.

• Identifying device models known to contain malware or reported as potentially vulnerable.

• Keeping security mechanisms such as Google Play Protect enabled.

• Isolating smart devices from the primary network by placing them on a separate VLAN or guest network.

• Blocking access to malicious command-and-control (C2) servers through DNS filtering and firewall rules.

• Regularly monitoring suspicious network traffic originating from connected devices.

• Remembering that a factory reset may not remove firmware-level malware. Infected devices without a trusted security update should be taken out of service or replaced.

  
  

  For more information, please contact our security experts at info@zerosecond.ae.