What happened?
According to Google Threat Intelligence Group, a backdoor built into software on multiple devices manufactured by Videostrong let operators silently load malicious modules. Google attributes the development and operation of this scheme to the manufacturer with high confidence. Google and partners disrupted its command infrastructure.
What were compromised devices used for?
Malicious modules could route third-party traffic through owners’ internet connections, participate in residential proxy networks, commit advertising fraud, and install further malware. Owners might have had no idea that their equipment was being used in these activities.
Are the boxes safe now?
Not necessarily. Taking down command servers does not remove the backdoor from individual devices. Google describes an XCPE component embedded in a system partition that can return after removal. Uninstalling an app or performing a factory reset therefore cannot be assumed to clean the device. Nor does a brand name alone prove that every unit is affected: device models and firmware versions matter.
What should owners do?
Record the exact brand, model and firmware version. Check manufacturer notices and researchers’ identified-device lists, which may not be complete. If a device is known to be affected or its provenance is suspicious, disconnect it from the network and ask the manufacturer for verified clean firmware or a replacement. Avoid unofficial firmware downloads. If sensitive credentials were entered on the device, change those passwords from a trusted device and monitor related accounts. Keeping IoT devices on an isolated network can limit access to other household equipment.
How to choose connected devices more carefully
Prefer identifiable retailers and manufacturers that publish updates and clear security support information. Check advertised certification, but remember that certification alone does not guarantee a device is free of malicious code: the XCPE case also involved devices that passed certification review.