The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately installing a persistent backdoor into devices it manufactured and selling access to criminal affiliates. These affiliates used the backdoored devices to deploy malicious modules that were used fir ad fraud, turned infected devices into residential proxies, and installed additional malware. As part of the disruption, Google says it took down XCPE command-and-control (C2) servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices.
These additional devices were compromised through malware distributed through other means than XCPE, and include retail set-top boxes, karaoke machines, and telehealth hardware. Google says that not all of them are Android devices.
