Google's Threat Intelligence Group has made a significant breakthrough in dismantling a massive botnet that had been secretly operating on over 1.3 million Android TV devices. The botnet, known as x.cpe, was particularly concerning due to its ability to evade detection by Google's screening process. According to Google, the malware was able to do so by employing sophisticated obfuscation techniques developed by Shenzhen-based Videostrong Technology. The x.cpe botnet was a modular three-stage malware platform that was sold to third parties, allowing them to access and control the compromised devices. This was made possible by a backdoor that enabled the malware to remotely install itself on the devices after they were set up and connected to the internet. The malware would then phone home to its operators, who could then install additional malicious modules. The compromised devices, which were mostly sold under the MECOOL brand, had been certified by Google, which is supposed to ensure that they meet certain security standards. However, the malware was able to bypass these checks by disabling Play Protect, a feature that would have otherwise flagged the malicious packages as such. Google's Threat Intelligence Group has worked to dismantle the botnet, and the company has taken steps to prevent similar incidents in the future. The incident highlights the importance of ongoing security measures and the need for manufacturers to prioritize security in their devices. The x.cpe botnet is a significant example of the evolving nature of malware and the need for constant vigilance in the fight against cyber threats. Google's efforts to dismantle the botnet demonstrate the company's commitment to protecting its users and the wider Android ecosystem.