I'm excited to read through the full writeup when I get a chance. I've been wondering how they "assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co." showing it was malice and not just incompetence.

I've had a Meecool KM6 that I've been using since I bought used several years ago. On day one, XCPE crashed, so I disabled it through PM, which stopped it from running. I'd assumed the botnet was exploiting a bug, because the software is buggy to start with.

Also, XCPE didn't prevent Andoid from going to sleep, which disconnects it from the network, so it missed out on a lot potential activity.