The Google Threat Intelligence blog describes,
in great detail, the XCPE botnet, which has just been taken down.

Last week, Google and industry partners dismantled the XCPE
	backdoor which enrolled more than 1.3 million set-top boxes into a
	botnet. We assess with high confidence that the backdoor and botnet
	were intentionally developed, deployed, and operated for financial
	gain by Videostrong Technology Co., an Android Original Equipment
	Manufacturer (OEM) and Original Device Manufacturer (ODM).

Videostrong monetized the backdoor by selling access to criminal
	affiliates and loading those affiliates' malware modules onto
	infected devices. These secondary modules were conducting ad-fraud;
	silently enrolling infected devices into residential proxy
	networks; and loading additional malware onto XCPE-compromised
	devices.

https://lwn.net/Articles/1104847/
--- SBBSecho 3.38-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)