A Chinese company has been infecting Android converters with malware for years; They were sold in Russia. About 1.3 million Android devices, including the popular Mecool KM2, KM2 Plus, KM6, KM7, KM9 Pro, were found to be part of the XCPE botnet. The malware was built directly into the firmware at the manufacturing plant. According to Google, behind this was the Chinese company Videostrong Technology, which not only distributed infected devices, but also sold access to them to other cybercriminals. The botnet operated in more than 200 countries, including Russia. Infected consoles were able to execute malicious commands while owners were watching movies or using other applications. Devices have become residential proxy nodes: Through the user's home Internet connection and IP address, criminals can route third-party traffic. Other malicious modules used converters to engage in ad fraud by simulating views and clicks. In addition, the devices downloaded new malware.

A Chinese company has been infecting Android converters with malware for years; They were sold in Russia. About 1.3 million Android devices, including the popular Mecool KM2, KM2 Plus, KM6, KM7, KM9 Pro, were found to be part of the XCPE botnet. The malware was built directly into the firmware at the manufacturing plant. According to Google, behind this was the Chinese company Videostrong Technology, which not only distributed infected devices, but also sold access to them to other cybercriminals. The botnet operated in more than 200 countries, including Russia. Infected consoles were able to execute malicious commands while owners were watching movies or using other applications. Devices have become residential proxy nodes: Through the user's home Internet connection and IP address, criminals can route third-party traffic. Other malicious modules used converters to engage in ad fraud by simulating views and clicks. In addition, the devices downloaded new malware.