[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwtiqLMUTIh45ikl5-C8C3FZCT0DDL6ukN7wczg3T9zw":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"f096b378-55cb-487a-ab2c-96eb7ff0f4e4","Google shuts down global botnet running on certified Android devices","google-shuts-down-global-botnet-running-on-certified-android-devices-0a35b6","Videostrong sold TV set-top boxes and other devices with pre-installed malware. The yearslong operation evaded Google’s security tests and established a botnet for cybercriminals. The post Google shuts down global botnet running on certified Android devices appeared first on CyberScoop.","Google, in collaboration with international partners, has shut down the XCPE botnet, which compromised over 1.3 million Android TV set-top boxes and other devices. The botnet was operated by Videostrong Technology Co., an approved Android device manufacturer that pre-installed malware, allowing for ad fraud, data theft, and malicious traffic routing. Google has banned Videostrong and is enhancing its security review processes to prevent similar incidents.","Google dismantles XCPE botnet on over 1.3M certified Android devices, operated by Videostrong.","https:\u002F\u002Fcyberscoop.com\u002Fgoogle-disrupts-xcpe-botnet-videostrong-android-devices\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F11\u002FGettyImages-675079700-2.jpg","2026-11-02T21:58:24+00:00","2026-11-02T22:00:41.360761+00:00",8,[17,20,22],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Videostrong Technology Co.",{"name":23,"type":24},"Android","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":51,"vendors":130},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":82,"name":83,"problem":84,"products":85},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":104,"url":107,"description":108},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[114,122],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[131],{"slug":132,"name":18,"logo_path":133,"roles":134},"google","\u002Fvendor-logos\u002Fgoogle.png",[135,136],"reported_by","affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"certified-android-manufacturer-pre-installs-malware-enabling-13m-device-botnet","Certified Android Manufacturer Pre-Installs Malware, Enabling 1.3M-Device Botnet","The XCPE botnet demonstrates how supply chain trust can be weaponised: Videostrong Technology, a certified Android device manufacturer, pre-installed malware on over 1.3 million devices before they ever reached consumers, bypassing the assumption that certified hardware is safe. Because the malicious code was baked into firmware by an approved vendor, traditional endpoint defences and user behaviour had no opportunity to intervene. This incident matters because it shows that certification programmes alone are insufficient — continuous behavioural monitoring of certified partners and their devices is essential. The scale of ad fraud, data theft, and traffic routing achieved highlights how deeply a supply chain compromise can affect end users who had no reasonable way to detect the threat.",[142,143,144,145,146,147,148],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1195: Supply Chain Compromise","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":150,"NIST SP 800-53 SI-2: Flaw Remediation":151,"CIS Control 15: Service Provider Management":152,"MITRE ATT&CK T1195: Supply Chain Compromise":153,"CIS Control 13: Network Monitoring and Defense":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 explicitly requires supply chain security measures, including assessments of the security practices of suppliers and service providers, which would have obligated Google to audit Videostrong's build and distribution processes before granting certification.","SI-2 covers the identification and remediation of firmware and software flaws across the supply chain, which would have required Google to verify that certified manufacturers' firmware was free of malicious or vulnerable code prior to distribution.","This control requires organisations to establish and enforce security requirements for third-party vendors and service providers; applying it to hardware manufacturers like Videostrong would have mandated firmware audits before certification was granted.","This technique describes adversaries tampering with software or hardware prior to delivery; recognising and threat-modelling against T1195 would have led Google to implement pre-ship firmware integrity checks as a standard certification requirement.","Continuous network monitoring for anomalous device behaviour — such as the ad-fraud beaconing and proxy traffic generated by XCPE — would have detected the botnet activity far earlier, limiting the number of devices and duration of compromise.","This control mandates timely identification and remediation of technical vulnerabilities in hardware and software, including third-party supplied components, which would have prompted periodic firmware scanning of certified devices.","Proper governance of who is trusted to supply certified hardware — and under what verifiable conditions — falls under this function; stronger identity and trust controls on the manufacturer relationship would have reduced the risk of a certified partner abusing that status."]