Google's Threat Analysis Group announced that it had neutralized the malicious program XCPE in cooperation with Japan's National Police Agency. XCPE had been preinstalled on more than 1.3 million TV set-top boxes in total, with the backdoor planted by the device manufacturers themselves.
Google's Threat Analysis Team announced that it had neutralized the malicious program known as XCPE in cooperation with Japan's National Police Agency and industry partners. XCPE was reportedly embedded in multiple models and brands for an extended period, and was designed to restore itself after reboot even if users deleted it. It was also found to have a function that disabled Google Play Protect on the devices without authorization and installed other apps without authorization.
Videostrong Technology, reportedly a Chinese company based in Shenzhen, developed and operated XCPE. The case was notable because the device manufacturers themselves had embedded the backdoor, and the act was determined to have been intentional.
The malicious program was reportedly sold to other criminal groups as access to compromised devices, with the aim of exploiting the hijacked devices. The criminal groups used the devices for ad fraud and as residential proxies to relay communications with external parties. Routing communications through home internet connections is believed to help conceal the perpetrators' identities.
Japan's National Police Agency is involved in the case and is reportedly investigating and addressing the impact on the affected devices jointly with the relevant authorities. Attention is also focused on future measures, including stronger pre-shipment testing and preventive measures.