Backdoors were embedded in the firmware of more than 1.3 million Android devices during manufacturing. Google assessed that manufacturer Videostrong deliberately developed and operated them and revoked its certification eligibility; Japan's National Police Agency also participated in the international effort.

Key points

What happened: Google disrupted "XCPE," a botnet encompassing more than 1.3 million Android devices; manufacturer Videostrong had deliberately embedded backdoors in their firmware

Why it matters: Infected devices were turned into residential proxies, abusing users' home connections as routes for criminal traffic; more than 3.8 million IP addresses were used as criminal infrastructure over four months

What remains: Malware remains on devices after the disruption; this case shows that even Android certification did not guarantee the integrity of the manufacturing process

A backdoor planted by the manufacturer

Google Threat Intelligence Group (GTIG) took legal action and disrupted…