Google disrupts XCPE botnet of 1.3M+ Android TV boxes backdoored in firmware by Videostrong, bans the maker from certified Android

Linha do tempo

1. cyberscoop.com ↗ · pub. 02/11/2026 18:58 · coletado 02/11 19:00

   Google disrupts XCPE botnet pre-installed by Videostrong on 1.3M+ TV set-top boxes

   ler a análise desta fonte ocultar

   Google and partners disrupted XCPE, a botnet built from a backdoor that China-based Android OEM Videostrong Technology Co. deliberately pre-installed on more than 1.3 million TV set-top boxes. According to a Google Threat Intelligence Group (GTIG) report, cybercriminals used the infected devices for ad fraud, data exfiltration and routing malicious traffic through residential proxy networks. Google took legal action against the domains and servers Videostrong used for control, and also took down command-and-control domains of more than a dozen malware families that ran as modules through the XCPE backdoor. Google says this disrupted access to at least 10 million additional compromised devices from other manufacturers. It banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process without disclosing details. The botnet spanned more than 170 countries, with the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 infected devices in the United States between June and October (per TrendAI). The takedown is already completed and involves no CVE; the severity is rated medium for defenders, although the scale of the compromise (1.3 million devices, more than 170 countries) is large.

   Technical Details

   • Videostrong shipped devices with malware for years and evaded Google's security tests by loading the malicious code after the device's first boot.
   • The operators constantly evolved configurations to evade Google's pre- and post-launch detections, per GTIG's Charley Snyder.
   • Most infected devices were Android TV set-top boxes; infected Android-based telehealth devices, karaoke machines and digital signs were also observed.
   • Google assesses the campaign was not an isolated rogue insider or a development oversight.
   • Partners in the disruption: Japan's National Police Agency, Lumen Technologies, Human Security, Plume and Synthient. TrendAI researchers provided the geographic distribution.
   • Google warns the markets for backdoors, ad fraud and residential proxies are resilient and operate as an interconnected supply chain.

   Remediation

   • The article gives no user-facing guidance.
2. theregister.com ↗ · pub. 02/11/2026 16:03 · coletado 02/11 17:00

   Coalition disrupts XCPE Android backdoor botnet of 1.3M TV boxes preinstalled by Videostrong

   ler a análise desta fonte ocultar

   A coalition of Google, Lumen, Human Security, Plume, Synthient and TrendAI, working with Japan's National Police Agency, disrupted XCPE, a backdoor that formed a botnet of more than 1.3 million Android devices in over 200 countries. Google Threat Intelligence Group (GTIG) assesses with high confidence that Shenzhen-based hardware manufacturer Videostrong Technology deliberately developed, embedded and operated the backdoor for financial gain. Videostrong sold access to criminal affiliates, who installed additional malware modules on TV boxes and projectors shipped to unsuspecting customers. The coalition also took down affiliate C2 domains, which GTIG assesses will sever access to at least 10 million additional compromised devices. The operation belongs to the same ecosystem as BadBox 2.0, disrupted in March 2025.

   Technical Details

   • XCPE was embedded in device firmware. A preinstalled management agent posed as a standard remote-management client (TrendAI).
   • The agent pulled updates from a GitHub page and connected to an MQTT server, giving the operator full remote control: install and remove apps, change settings, push updates.
   • Infected devices were used as residential proxies to hide malicious traffic behind customers' home internet connections.
   • Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses tied to the operation.
   • Affiliates use diversified distribution channels for their modules beyond XCPE.

   Remediation

   • Google cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps.
   • The article gives no user-side remediation steps. Defenders should treat Videostrong-built Android TV boxes and projectors as potentially compromised.
   • Videostrong did not respond to The Register's inquiries.
3. bleepingcomputer.com ↗ · pub. 02/11/2026 15:16 · coletado 02/11 17:00

   Google disrupts XCPE Android botnet of 1.3M TV boxes backdoored at the factory by Videostrong, bans the maker

   ler a análise desta fonte ocultar

   Google and partners dismantled the XCPE botnet, made up of more than 1.3 million Android TV boxes whose firmware was backdoored during manufacturing. Google's Threat Intelligence Group (GTIG) attributes it with high confidence to the Chinese manufacturer Videostrong Technology Co, which allegedly sold access to criminal affiliates for ad fraud, residential proxy services and further malware installation. The disruption also took down C2 servers used by more than a dozen related malware families, cutting off at least 10 million other compromised devices (set-top boxes, karaoke machines, telehealth hardware, not all of them Android). Google revoked Videostrong's license to build Android TV devices with Google apps and banned it and its future affiliates from producing certified Android devices. The malware remains on infected devices and reinstalls itself if removed.

   Technical Details

   • The main backdoor, tracked as x.cpe and com.oemservice, runs with Android system privileges and is embedded in firmware. It has a modular architecture that separates backdoor functions from revenue-generating modules.
   • At boot it contacts C2 on anyevonline[.]com (subdomains vary by Android version and device type) to get connection details and credentials for an MQTT broker (mqtt.szbboys[.]com), which is used to receive commands.
   • Capabilities: silent app installation, disabling Google Play Protect, shell commands and scripts with system privileges, screenshots, keystroke injection, collection of account, device, app and log data, network reconnaissance and reverse shells.
   • Modules monetized devices through residential proxy services (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer) and ad fraud (impressions, hidden pages, ad clicks). Some modules installed further backdoors: Moyu, Spirit and Bird.
   • In late 2024 Videostrong introduced the loader com.abc.nexus. Since August 2026 it has been replaced with smaller droppers disguised as Android system apps.
   • Synthient traced the backdoor to Videostrong from a MECOOL KM9PRO Max box bought in late 2025. It found an open directory on file.anyevonline[.]com containing backdoors and a PDF by Videostrong's R&D director. videostrong[.]cn resolved to the same IP as mqtt.anyevonline[.]com, and Videostrong email addresses were used to sign the backdoors.
   • Videostrong used obfuscation to evade Google's certification testing and loaded malicious code after first boot. Google has changed its certification review process.
   • Partners in the disruption: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

   Remediation

   • The takedown did not clean infected devices: the malware reinstalls itself from the /oem/ partition if removed.
   • Install clean firmware on affected devices, or disconnect them from the internet to stop malicious activity.
4. helpnetsecurity.com ↗ · pub. 02/11/2026 12:50 · coletado 02/11 14:01

   Google disrupts XCPE Android TV botnet of 1.3M devices and bans Videostrong Technology

   ler a análise desta fonte ocultar

   Google disrupted XCPE, a backdoor embedded in the firmware of Android TV set-top boxes, and Google Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the manufacturer of many of the boxes. More than 1.3 million devices were enrolled. The company sold access to criminal affiliates, who pushed their own modules for hidden ad fraud, residential proxy enrollment, theft of account details and logs, and further malware installation. Google estimates that taking down the affiliates' command domains cuts off at least 10 million more compromised devices that arrived through other routes and malware families. Google took legal action against the infrastructure and banned Videostrong and its future subsidiaries and affiliates from building certified Android devices.

   Technical Details

   • The main component runs with system privileges and reinstalls itself from a protected partition after reboot, so deleting the app does not clear the device.
   • It disables Google Play Protect by rewriting the package verification setting and wipes records of user consent.
   • Operators can take live screenshots, inject keystrokes and open a shell on the device.
   • Since August 2026, operators have installed droppers disguised as system packages that use a privilege escalation exploit to write to the system partition, making removal harder.
   • Besides set-top boxes, other infected Android-based IoT devices include telehealth devices, karaoke machines and digital signage.
   • Affiliate modules were used for hidden ad views, residential proxy networks, credential and log theft, and delivery of more than a dozen malware families.

   Remediation

   • Google took legal action against the tasking and module delivery domains and servers, and against the command infrastructure of more than a dozen malware families.
   • Google tightened firmware integrity checks for certified Android TV devices and changed its manufacturer review process to close the testing gap that was abused.
   • Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI contributed to the takedown.
   • Because deleting the app does not remove the implant, owners of affected boxes cannot rely on uninstalling it.
5. thehackernews.com ↗ · pub. 02/11/2026 12:50 · coletado 02/11 14:00 primeiro registro

   Google disrupts 1.3M-device Android botnet and blames TV box maker Videostrong for x.cpe firmware backdoor

   ler a análise desta fonte ocultar

   Google led a takedown in late October 2026 of a botnet of more than 1.3 million Android devices, mostly TV set-top boxes. Google says it is highly confident that Shenzhen-based maker Videostrong intentionally built the x.cpe backdoor into its firmware and sold access to criminals. The operators used the boxes for ad fraud and as residential proxies. Google used legal action to take down the botnet's C2 domains and servers, plus the control domains of more than a dozen malware families loaded through the backdoor, and banned Videostrong from building or selling certified Android devices. The backdoor remains on devices in the field, and owners cannot remove it themselves.

   Technical Details

   • x.cpe runs as a system app inside the firmware, signed with the maker's key and with system-level access. It reports to C2 servers and waits for orders. To install software silently, it first disables app checks in Google Play Protect.
   • Capabilities: silent app installation, command execution, screen capture and network mapping. Google observed live screenshots, keystroke injection, theft of account details, device information, app lists and system logs, and reverse shells.
   • Most modules turned the boxes into residential proxies or sold their bandwidth. Others faked online ad views.
   • Because x.cpe is part of the firmware, it reinstalls itself on restart, so removal does not persist.
   • Attribution to Videostrong rests on several points:
     • x.cpe passes C2 settings to other Videostrong apps, including the YokaTV Player streaming app.
     • A GitHub account hosting botnet packages is named yf-videostrong.
     • Synthient found a document signed by Videostrong's R&D director in an open folder on a botnet server.
     • A Videostrong web domain shares an IP address with the operators' control panel.
     • Plume found that Videostrong supplies both the firmware and the remote management tools.
   • Google says Videostrong hid its code to bypass a gap in its compatibility and security tests and loaded the malicious code after first boot. Google has changed its review process.
   • TrendAI (Trend Micro) counted 1,472,554 infected devices across 206 models between June 3 and October 1, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan. The US, Germany, UK, Australia and Canada each had about 26,000 to 42,000.
   • Synthient published a list of 182 device model names (a model name alone does not confirm infection). Its report focuses on MECOOL-branded boxes, and a purchased MECOOL KM9PRO Max had the backdoor preinstalled.
   • Plume found more than a dozen devices, mostly MECOOL, using the C2 server. It reports that both Google-certified and AOSP devices were affected.
   • Besides TV boxes, the backdoor also appeared on telehealth devices, karaoke machines and digital signage.
   • Google expects the action to cut off access to at least 10 million more infected devices, but warns that operators switch tools quickly.
   • Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI assisted in the operation.

   Remediation

   • Plume recommends a full factory reset, but does not say whether it removes x.cpe itself. Synthient advises discarding affected boxes.
   • Organizations should use Synthient's published indicators to find MECOOL or similar devices, disconnect and discard any found, and block the listed C2 domains and IPs.
   • Keep smart devices on separate network segments away from sensitive systems.
   • TrendAI advises treating unmanaged consumer devices on remote staff's home networks as part of the attack surface and keeping corporate access behind managed devices.
   • TrendAI says cleanup needs vendor action, platform protection or device replacement.