botnet operators

Google has cut ties with a company behind a botnet that secretly operated on 1.3 million Android TV boxes, dismantling the campaign. The infected devices were reportedly enrolled without owners' knowledge, and Google's action ends its business relationship with the firm responsible. The case highlights ongoing security risks from low-cost Android-based streaming hardware and the difficulty of detecting malicious software hidden in consumer devices.

Authorities have taken down a botnet spanning roughly 1.3 million infected Android TV boxes. Researchers say a hidden backdoor turned the streaming devices into tools for criminals, carrying out attacks and fraud without owners' knowledge. Security firms including Malwarebytes reported on the operation, describing one of the larger botnets built on consumer Android hardware in recent years.

An industry-led operation has dismantled a botnet concealed in more than 1.3 million TV set-top boxes spread across 200 countries, according to a PR Newswire release. The infected devices were reportedly hijacked without owners' knowledge, and the coordinated takedown involved security firms and network operators working together to disrupt the infrastructure.

Google announced the takedown of the XCPE botnet, which hijacked around 1.3 million Android TV boxes and streaming devices to power ad fraud, proxies and other malicious activity. Google's Threat Intelligence team detailed the operation on its blog, and Brian Krebs of KrebsOnSecurity reported that several tech firms jointly dismantled the network of infected set-top boxes.

Google says it has taken down a botnet that secretly operated on about 1.3 million Android TV boxes, hijacking consumer devices to carry out malicious activity without their owners' knowledge. The operation highlights growing security risks from cheap smart TV hardware, and the scale of the infected devices is drawing attention to how easily everyday gadgets can be weaponized.

Google says it has disrupted the XCPE botnet and banned the company responsible for operating it. The action reportedly targets infrastructure used to run malicious traffic at scale. The move adds to a series of enforcement measures by major tech firms against botnet networks and the commercial entities behind them.

Google, working with security researchers and law enforcement partners, has taken down a large-scale botnet known as BadBox. Around 1.3 million Android TV boxes and other devices had been compromised with malware before leaving the factory, turning them into tools for fraud, ad abuse and other criminal activity. The operation highlights growing concerns over insecure low-cost smart devices shipped with backdoors already installed.

Google has dismantled a global botnet that operated on certified Android devices, according to reporting by CyberScoop. The operation targeted legitimate, certified handsets, making the infected devices harder for users to detect. Details on the botnet's operators, scale and purpose have not been fully disclosed, but the takedown marks a significant action against malware embedded in officially certified Android hardware worldwide.

LWN has published a threat intelligence article detailing efforts to shut down the XCPE botnet, which reportedly targets Android and Linux systems. The piece outlines how the malware operates and what defenders can do to close off the attack routes it uses, drawing attention within the Linux and security communities.

Technology companies have taken down a botnet that hijacked roughly 1.3 million Android TV boxes and used them as residential proxy nodes, reportedly to relay traffic for fraud, account abuse and anonymised browsing. The operation disguised malicious software as legitimate streaming apps, letting attackers rent out the devices' connections. The takedown is drawing attention to weak security in cheap Android-based set-top devices widely used for streaming.

A botnet dubbed with poetry-themed elements compromised more than 3,000 servers and used them to secretly mine cryptocurrency. The malware hid in poetry-related files and infrastructure, allowing it to evade detection while draining victims' computing power. Security researchers have detailed how the operation worked and how the servers were compromised.

Dutch security firm Eye Security took over Popcorn Time's abandoned update infrastructure and pushed more than 2 million updates that remotely disable the app's updater. The move prevents dormant clients from being hijacked into a botnet. Security experts say the operation highlights how abandoned software remains a systemic supply-chain risk.