Google dismantles XCPE backdoor botnet of 1.3M Android set-top boxes allegedly run by OEM Videostrong

Linha do tempo

1. securityaffairs.com ↗ · pub. 03/11/2026 06:52 · coletado 03/11 08:00 primeiro registro

   Google dismantles XCPE backdoor botnet of 1.3M Android set-top boxes allegedly run by OEM Videostrong

   ler a análise desta fonte ocultar

   Google and its partners disrupted XCPE, a backdoor preloaded in firmware that enrolled more than 1.3 million Android TV set-top boxes and other devices into a botnet. Google assesses with high confidence that the OEM/ODM Videostrong Technology Co. deliberately built, spread and operated it for profit, selling access to criminal affiliates who loaded ad-fraud, residential proxy and other malware modules. Google banned Videostrong from making devices with pre-installed Google apps, took legal action against its command-and-control domains and servers and against the C2 domains of over a dozen affiliate malware families, and expects the takedown to cut access to at least 10 million more compromised devices. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI supported the operation.

   Technical Details

   • Three-stage malware: the primary backdoor x.cpe (also com.oemservice) is preloaded in firmware, runs with system privileges and reinstalls itself from the /oem/ partition at the next reboot if uninstalled. It hands work to the loader com.abc.nexus, which has anti-analysis features and sets up the monetization modules.
   • Obfuscation and delayed loading of the malicious code after first boot let it evade Google's compatibility and security tests.
   • C2 works in two steps: an HTTP request downloads settings, location and network data, then a persistent MQTT connection receives commands. All analyzed samples used the same MQTT server. Operators managed infrastructure via remote interfaces and an EMQX web console.
   • Operator capabilities: silent app installation, command and script execution, screenshots, keystroke recording, network mapping, collection of account/device info, app lists and logs, remote shell sessions, and disabling Google Play Protect verification. Most activity was installing, removing and managing malware modules.
   • Payloads are mostly hosted as GitHub releases on operator-owned accounts, plus the Filemail service and two operator-controlled servers.
   • Modules: residential proxy and bandwidth-sharing kits (Linkfog, AppSalt, GaGaNode, BWM, Traffmonetizer, EarnFM, NetNut), with up to three proxy kits per device, and ad-fraud modules Fission and HiddenView (fake impressions, hidden browser windows simulating clicks and scrolling). AppSalt's SDK (owned by Honeygain) calls an opt-in function without a consent screen.
   • Devices are assigned to six timezone-based pools on ott.szbboys[.]com, with per-module resource limits and priority weights.
   • Affected devices are mostly Android TV boxes, but also telehealth devices, karaoke machines and digital signage, across multiple brands and models over several years.

   Remediation

   • Buy connected devices only from reputable manufacturers and check the partner list on Google's Android TV website; keep Google Play Protect enabled.
   • Avoid apps that pay for "unused bandwidth" or "sharing your internet", and review permissions of third-party VPN and proxy apps.
   • Retailers and distributors should require independent security audits of device makers and delist those implicated in supply-chain abuse; proxy providers should offer auditable proof of user consent.
   • Google has changed its review process and is improving firmware checks on certified Android TV devices.