Coalition disrupts XCPE Android backdoor botnet of 1.3M TV boxes preinstalled by Videostrong
A coalition of Google, Lumen, Human Security, Plume, Synthient and TrendAI, working with Japan's National Police Agency, disrupted XCPE, a backdoor that formed a botnet of more than 1.3 million Android devices in over 200 countries. Google Threat Intelligence Group (GTIG) assesses with high confidence that Shenzhen-based hardware manufacturer Videostrong Technology deliberately developed, embedded and operated the backdoor for financial gain. Videostrong sold access to criminal affiliates, who installed additional malware modules on TV boxes and projectors shipped to unsuspecting customers. The coalition also took down affiliate C2 domains, which GTIG assesses will sever access to at least 10 million additional compromised devices. The operation belongs to the same ecosystem as BadBox 2.0, disrupted in March 2025.
Detalhes técnicos
- XCPE was embedded in device firmware. A preinstalled management agent posed as a standard remote-management client (TrendAI).
- The agent pulled updates from a GitHub page and connected to an MQTT server, giving the operator full remote control: install and remove apps, change settings, push updates.
- Infected devices were used as residential proxies to hide malicious traffic behind customers' home internet connections.
- Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses tied to the operation.
- Affiliates use diversified distribution channels for their modules beyond XCPE.
Remediação
- Google cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps.
- The article gives no user-side remediation steps. Defenders should treat Videostrong-built Android TV boxes and projectors as potentially compromised.
- Videostrong did not respond to The Register's inquiries.
Linha do tempo
-
Coalition disrupts XCPE Android backdoor botnet of 1.3M TV boxes preinstalled by Videostrong
ler a análise desta fonte ocultar
A coalition of Google, Lumen, Human Security, Plume, Synthient and TrendAI, working with Japan's National Police Agency, disrupted XCPE, a backdoor that formed a botnet of more than 1.3 million Android devices in over 200 countries. Google Threat Intelligence Group (GTIG) assesses with high confidence that Shenzhen-based hardware manufacturer Videostrong Technology deliberately developed, embedded and operated the backdoor for financial gain. Videostrong sold access to criminal affiliates, who installed additional malware modules on TV boxes and projectors shipped to unsuspecting customers. The coalition also took down affiliate C2 domains, which GTIG assesses will sever access to at least 10 million additional compromised devices. The operation belongs to the same ecosystem as BadBox 2.0, disrupted in March 2025.
Technical Details
- XCPE was embedded in device firmware. A preinstalled management agent posed as a standard remote-management client (TrendAI).
- The agent pulled updates from a GitHub page and connected to an MQTT server, giving the operator full remote control: install and remove apps, change settings, push updates.
- Infected devices were used as residential proxies to hide malicious traffic behind customers' home internet connections.
- Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses tied to the operation.
- Affiliates use diversified distribution channels for their modules beyond XCPE.
Remediation
- Google cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps.
- The article gives no user-side remediation steps. Defenders should treat Videostrong-built Android TV boxes and projectors as potentially compromised.
- Videostrong did not respond to The Register's inquiries.