Google Dismantles XCPE Botnet of 1.3M+ Android TV Boxes After Tracing Backdoor to Maker Videostrong

Linha do tempo

1. olhardigital.com.br ↗ · pub. 05/11/2026 14:15 · coletado 05/11 16:00

   TV Boxes Shipped from Factory with XCPE Malware; Brazil Ranks Second-Most-Infected Country Worldwide

   This article, from a Brazilian outlet, confirms Brazil's position as the second most XCPE-infected country worldwide (after Malaysia, per Trend Micro) and adds the national telecom regulator Anatel's response: although it did not participate in the Google-led takedown, Anatel publicly warned that unhomologated (non-certified) devices threaten both consumers and Brazil's telecommunications infrastructure, a local regulatory angle not present in the existing report.

   ler a análise desta fonte ocultar

   This article, from a Brazilian outlet, confirms Brazil's position as the second most XCPE-infected country worldwide (after Malaysia, per Trend Micro) and adds the national telecom regulator Anatel's response: although it did not participate in the Google-led takedown, Anatel publicly warned that unhomologated (non-certified) devices threaten both consumers and Brazil's telecommunications infrastructure, a local regulatory angle not present in the existing report.

   A Google-led operation dismantled a global botnet of more than 1.3 million devices, mostly Android TV boxes, that were infected with the XCPE malware before leaving the factory. Brazil was the second most affected country, behind only Malaysia, according to Trend Micro. The operation also involved Japan's National Police Agency and the companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Beyond TV boxes, Google also found the backdoor on telemedicine devices and digital signage equipment.

   Technical Details

   The manufacturer Videostrong, based in Shenzhen, China, intentionally installed the malicious program on its devices since late 2024, meaning the infection did not depend on users clicking suspicious links — the devices already left the factory compromised. The company profited by selling criminals access to the infected devices, which were used to simulate ad views and generate fraudulent advertising revenue. To conceal the scheme, Videostrong used techniques that bypassed the compatibility and security checks required by Google, allowing the malicious code to load only after the device was first powered on.

   Remediation

   After identifying the practice, Google cut ties with Videostrong and banned the manufacturer from producing or selling certified Android devices, or supplying software to other certified manufacturers, and also modified its review process to protect consumers. In Brazil, the national telecom regulator Anatel warned about the risks of using unhomologated (non-certified) equipment, stating it fights the sale of such products due to the threats they pose to consumers and to telecommunications networks, even though it did not take part in the Google-led operation. Anatel's inspection superintendent, Gesiléa Fonseca Teles, said the concern goes beyond service quality or device safety, since the origin and compliance of equipment are also important to protect the country's telecommunications infrastructure.

2. securityaffairs.com ↗ · pub. 03/11/2026 06:52 · coletado 03/11 08:00

   Google Dismantles 1.3M-Device XCPE Botnet Built into Videostrong-Made Set-Top Boxes

   This article adds operational details about the XCPE infrastructure not previously captured: operators distributed secondary payloads via the Filemail file-sharing service in addition to GitHub releases, and managed command infrastructure through remote interfaces and an EMQX web console. It also describes a device-pooling scheme assigning infected boxes to one of six timezone-based pools hosted on ott.szbboys[.]com, with MQTT messages carrying per-module resource limits, processor-specific download links and priority weights, and confirms that a single device can run up to three residential proxy kits simultaneously. Finally, it details Google's broader remediation call to retailers, distributors and the residential proxy industry for independent audits, delisting and transparent consent verification, plus specific consumer guidance (securityaffairs.com).

   ler a análise desta fonte ocultar

   This article adds operational details about the XCPE infrastructure not previously captured: operators distributed secondary payloads via the Filemail file-sharing service in addition to GitHub releases, and managed command infrastructure through remote interfaces and an EMQX web console. It also describes a device-pooling scheme assigning infected boxes to one of six timezone-based pools hosted on ott.szbboys[.]com, with MQTT messages carrying per-module resource limits, processor-specific download links and priority weights, and confirms that a single device can run up to three residential proxy kits simultaneously. Finally, it details Google's broader remediation call to retailers, distributors and the residential proxy industry for independent audits, delisting and transparent consent verification, plus specific consumer guidance (securityaffairs.com).

   Google and its partners dismantled XCPE, a backdoor-driven botnet that had enrolled more than 1.3 million set-top boxes, after concluding that Android device maker Videostrong Technology Co. deliberately built, distributed and operated the malware for profit. Google assesses with high confidence that Videostrong sold access to criminal affiliates and loaded their malware onto infected devices to generate ad fraud and residential proxy revenue, rather than this being a rogue employee or coding error. Google has banned Videostrong, and any future subsidiaries or partners, from building devices with pre-installed Google apps or supplying software to other certified OEMs, and has taken legal action against the botnet's control infrastructure and the C2 domains of more than a dozen affiliate malware families. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI supported the takedown, and Google expects the action to additionally cut off access to at least 10 million more compromised devices infected through other channels.

   Technical Details

   The primary backdoor, x.cpe (called com.oemservice in some builds), is preloaded in the firmware and runs with system privileges. If a user uninstalls it, it reinstalls itself from the /oem/ partition at the next reboot. It hands execution to a loader, com.abc.nexus, which carries anti-analysis tricks and deploys monetization modules supplied by criminal affiliates, turning devices into residential proxy exit nodes (Linkfog, AppSalt, GaGaNode, BWM, Traffmonetizer, EarnFM, NetNut) or ad-fraud engines (Fission, HiddenView). The backdoor uses two steps to control infected devices: it sends an HTTP request to download settings, location data and network information, then maintains a live MQTT connection, with all analyzed samples using the same MQTT server. Through this connection, attackers could secretly install apps, run commands and scripts, take screenshots, record keystrokes and map the victim's network, and could disable Google Play Protect's app verification to install software undetected. Attackers mainly used GitHub releases on their own accounts, the Filemail file-sharing service and two servers under their control, and network traffic analysis suggests operators managed the command infrastructure through remote interfaces and an EMQX web console, connecting from IP addresses outside the infected device network. One infected device can run several modules at once, up to three residential proxy kits, showing Videostrong seeks to maximize revenue per device, with infections also found on telehealth devices, karaoke machines and digital signage. MQTT messages carry resource limits for each module, download links per processor type, and priority weights, and devices are assigned to one of six timezone-based pools on ott.szbboys[.]com, reporting bandwidth use and alarms back to stay within set limits. Videostrong got around Google's compatibility and security tests with code obfuscation, loading the malicious code after a device's first boot, which the tests didn't catch.

   Remediation

   Google says the underlying market is resilient, as backdoor operators, ad-fraud rings and residential proxy providers work as an interconnected supply chain, switching to new loaders or rival kits when one part is disrupted; it calls for accountability across hardware makers, the residential proxy industry and the broader technology sector, urging retailers and distributors to require independent security audits and delist manufacturers implicated in supply-chain abuse. Google advises consumers to be cautious with apps that pay for "unused bandwidth" or "sharing your internet," to stick to trusted app stores, review third-party VPN/proxy permissions, keep Google Play Protect enabled, and buy connected devices only from reputable manufacturers listed on its Android TV partner page.

3. gbhackers.com ↗ · pub. 03/11/2026 02:11 · coletado 03/11 04:00

   Google Dismantles XCPE Botnet That Infected 1.3 Million Android TV Devices via Videostrong Factory Backdoor

   This article adds further technical detail on the XCPE backdoor's evasion and persistence mechanisms not previously documented: the loader's use of `libseccomp_guard.so` to block sandboxing and instrumentation, the deployment since August 2026 of droppers disguised as system apps such as `com.android.system.ntp`, use of `libexploit.so` to restart adbd with root access and remount the system partition read-write to copy files into `/system/priv-app/`, and the `persist.networkstack.uninstall` property used to manage cleanup. It also links the campaign to Google's earlier NetNut/Popanet disruption and its January 2026 takedown of the IPIDEA residential proxy network, and notes Videostrong removed malicious modules from x.cpe in late 2024 possibly in response to enforcement against the related BADBOX botnet family.

   ler a análise desta fonte ocultar

   This article adds further technical detail on the XCPE backdoor's evasion and persistence mechanisms not previously documented: the loader's use of libseccomp_guard.so to block sandboxing and instrumentation, the deployment since August 2026 of droppers disguised as system apps such as com.android.system.ntp, use of libexploit.so to restart adbd with root access and remount the system partition read-write to copy files into /system/priv-app/, and the persist.networkstack.uninstall property used to manage cleanup. It also links the campaign to Google's earlier NetNut/Popanet disruption and its January 2026 takedown of the IPIDEA residential proxy network, and notes Videostrong removed malicious modules from x.cpe in late 2024 possibly in response to enforcement against the related BADBOX botnet family.

   Google and industry partners have disrupted the XCPE botnet, a network of more than 1.3 million Android set-top boxes infected through a firmware-level backdoor. Google Threat Intelligence Group (GTIG) assesses with high confidence that Android OEM/ODM Videostrong Technology Co. deliberately built and operated the backdoor for profit, selling access to criminal affiliates who loaded ad-fraud, residential-proxy and further malware modules onto devices. Google also disrupted the C2 domains of more than a dozen affiliate malware families and expects the action to cut off access to at least 10 million additional compromised devices distributed through other channels. The investigation involved Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, and Google has banned Videostrong and any future subsidiaries or affiliates from building certified Android devices.

   Technical Details

   Since at least late 2024 the malware has used a modular design: the primary backdoor x.cpe (also com.oemservice) is preloaded in firmware, runs as android.uid.system, and reinstalls itself from the /oem/ partition on reboot if removed. The loader com.abc.nexus handles anti-analysis and module execution; monetization modules include proxy SDKs (Linkfog, AppSalt, NetNut, GaGaNode) and ad-fraud tools (CBOXTV, HiddenView). The botnet uses a two-stage C2 process: devices first send an AES-encrypted HTTP POST for configuration, then open a persistent MQTT connection to broker mqtt.szbboys[.]com, through which operators install apps, run shell commands, capture screens, inject keystrokes and map networks, including reverse shells and exfiltration of account data, package inventories and logs. The backdoor disables Google Play Protect by setting package_verifier_user_consent to -1, and the loader deploys libseccomp_guard.so to block sandboxing and instrumentation. Since August 2026, operators have mass-uninstalled com.abc.nexus and pushed droppers disguised as system applications such as com.android.system.ntp; some variants use libexploit.so to restart the Android Debug Bridge (adbd) with root access, remount the system partition as read-write, and copy themselves into /system/priv-app/, with properties like persist.networkstack.uninstall used to manage cleanup. Videostrong exploited a gap in Google's compatibility testing by loading malicious code only after the device's initial boot; Google has since revised its review process and firmware integrity checks. Google noted Videostrong removed malicious modules from x.cpe in late 2024, possibly in response to enforcement against the related BADBOX botnet family, and that the Popanet component matches malware from Google's earlier NetNut disruption, part of the same proxy economy targeted in Google's January 2026 disruption of the IPIDEA residential proxy network. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1 — a figure it calls a lower bound — with Malaysia, Brazil, Iraq, Mexico and Taiwan having the highest counts, and infections also found on telehealth devices, karaoke machines and digital signage, with some devices running as many as three proxy SDKs simultaneously.

   Remediation

   Owners cannot remove the implant themselves; TrendAI says cleanup requires vendor action, platform protection, or device replacement, while Plume recommends a full factory reset, though it does not say this removes x.cpe. Organizations should replace affected set-top boxes, avoid uncertified or off-brand Android TV hardware, and isolate smart devices on a guest network or separate segment. Defenders should block and monitor traffic to szbboys[.]com and anyevonline[.]com, watch for unexpected MQTT or proxy traffic from streaming devices, and block broker IPs 219.134.163[.]210 and 219.134.163[.]211.

4. krebsonsecurity.com ↗ · pub. 02/11/2026 23:24 · coletado 03/11 01:00

   Google and Partners Dismantle XCPE Botnet of 1.3M Android TV Boxes; Proxy Providers and MECOOL/Skyworth Named

   This article from KrebsOnSecurity adds details not in the prior reporting: it names the specific residential proxy providers whose SDKs were found on XCPE-infected devices (AppSalt/Honeygain owned by Oxylabs, which rebranded to Source in October 2026 after a $130 million Warburg Pincus investment valuing it at $3.6 billion; NetNut, operated by Alarum Technologies; EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode); links Videostrong's malware to the Grass proxy service previously tied to the Superbox TV box; reports that Synthient found the MECOOL TV box, made by Skyworth Technology, also carried Videostrong's malware and traces its popularity to a 2023 Linus Tech Tips video; and provides background on the related Kimwolf DDoS botnet, the Motion Picture Association's partnership with Synthient, and the FBI's July 2026 seizure of domains tied to NetNut/Alarum over the separate Popa botnet.

   ler a análise desta fonte ocultar

   This article from KrebsOnSecurity adds details not in the prior reporting: it names the specific residential proxy providers whose SDKs were found on XCPE-infected devices (AppSalt/Honeygain owned by Oxylabs, which rebranded to Source in October 2026 after a $130 million Warburg Pincus investment valuing it at $3.6 billion; NetNut, operated by Alarum Technologies; EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode); links Videostrong's malware to the Grass proxy service previously tied to the Superbox TV box; reports that Synthient found the MECOOL TV box, made by Skyworth Technology, also carried Videostrong's malware and traces its popularity to a 2023 Linus Tech Tips video; and provides background on the related Kimwolf DDoS botnet, the Motion Picture Association's partnership with Synthient, and the FBI's July 2026 seizure of domains tied to NetNut/Alarum over the separate Popa botnet.

   Google said it worked with industry partners to dismantle a botnet of more than 1.3 million Android TV set-top boxes that secretly rent out users' Internet connections to strangers via residential proxy services and conduct advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet's access to more than 10 million additional compromised systems, including Android-based healthcare devices and karaoke machines. The Google Threat Intelligence Group (GTIG) attributed the backdoor, dubbed XCPE, to Chinese TV box manufacturer Videostrong Technology Co., which it says monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices; Google has cut ties with Videostrong and took legal action against the domains and servers used to control the botnet and install additional malware.

   Technical Details

   GTIG's report names several residential proxy providers whose SDKs were routinely downloaded by XCPE-infected devices: AppSalt (also known as Honeygain), owned by Vilnius-based Oxylabs (relaunched as Source in October 2026 after a $130 million Warburg Pincus investment reportedly valuing the business at $3.6 billion); NetNut, operated by publicly traded Israeli firm Alarum Technologies; and EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode. Synthient founder Ben Brundage said Videostrong's malware also distributed software for the proxy service Grass, previously linked by Krebs to the Superbox TV streaming device via a Censys researcher, a connection Grass's founder had denied. Synthient separately examined a pre-infected set-top box sold under the brand MECOOL by publicly traded Chinese company Skyworth Technology, finding it bundled Videostrong's malware and AppSalt/Honeygain proxy components; MECOOL's popularity reportedly grew after being featured in a 2023 video by YouTube channel Linus Tech Tips (nearly 17 million subscribers), which has since reframed the video to call the product a scam and removed its affiliate links. Synthient, credited as an industry partner in the takedown, had published research in January 2026 on the Kimwolf botnet, which infected millions of Android set-top boxes almost overnight via a vulnerability in residential proxy services and launched large-scale DDoS attacks, prompting proxy providers to patch and fragmenting Kimwolf into smaller pieces; that work also drew the Motion Picture Association (MPA), which partnered with Synthient to purchase and tear apart popular Android TV boxes. Separately, in July 2026 the FBI seized hundreds of domains tied to NetNut/Alarum over a related TV-box botnet called Popa. Google requires Android device makers to pass compatibility and security tests, but Videostrong found a way to load its malicious software immediately after a device's first boot, a gap Google says it has since closed.

   Remediation

   Google banned Videostrong, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors, and has tightened firmware integrity checks and its manufacturer review process for certified Android TV devices, though it did not disclose specifics of the changes. The backdoor can reinstall itself on already-infected devices, so affected users may need to flash clean firmware or disconnect devices from the internet. Videostrong and Oxylabs did not respond to requests for comment.

5. cyberscoop.com ↗ · pub. 02/11/2026 18:58 · coletado 02/11 19:00

   Google Dismantles XCPE Botnet on 1.3M Certified Android Devices, Bans Maker Videostrong

   New reporting from CyberScoop adds geographic detail to the XCPE takedown: TrendAI researchers found the botnet spanned more than 170 countries (versus the previously reported 200), with the heaviest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and about 44,000 infected devices located in the United States between June and October. It also adds direct quotes from Charley Snyder, GTIG's head of disruption operations, confirming Videostrong evaded Google's detections by loading malicious code post-first-boot and that Google is withholding details of its updated review process to avoid tipping off threat actors.

   ler a análise desta fonte ocultar

   New reporting from CyberScoop adds geographic detail to the XCPE takedown: TrendAI researchers found the botnet spanned more than 170 countries (versus the previously reported 200), with the heaviest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and about 44,000 infected devices located in the United States between June and October. It also adds direct quotes from Charley Snyder, GTIG's head of disruption operations, confirming Videostrong evaded Google's detections by loading malicious code post-first-boot and that Google is withholding details of its updated review process to avoid tipping off threat actors.

   Google and a coalition of partners disrupted XCPE, a botnet that China-based Android device manufacturer Videostrong Technology Co. deliberately built into more than 1.3 million TV set-top boxes and other certified Android devices. The backdoors let cybercriminals run ad fraud, exfiltrate data, and route malicious traffic through residential proxy networks. Google took legal action to seize the domains and servers Videostrong used to control the botnet and also took down command-and-control infrastructure for more than a dozen malware families operating as modules through the XCPE backdoor, which it says additionally cut off access to at least 10 million more compromised devices from other manufacturers. Google has banned Videostrong and any future subsidiaries from building or selling certified Android devices and updated its vendor review process, though it is not disclosing the specifics of those changes to avoid helping threat actors evade them.

   Technical Details

   Google researchers wrote that they found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates, and said they believe this campaign wasn't an isolated rogue insider or a development oversight. Videostrong sold Android devices with pre-installed malware for years, slipping by Google's security tests by loading the malicious code after the device's first boot, and Charley Snyder, head of disruption operations at GTIG, said the XCPE operators constantly evolved its configurations to evade Google's pre and post-launch detections. Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs. Researchers said that without users' knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors, leading to ad-fraud, data exfiltration, and routing of malicious network traffic through the devices. According to TrendAI researchers cited in the article, the botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 infected devices were based in the United States between June and October.

   Remediation

   Google banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process to detect and stop similar activities in the future, though Snyder said the company isn't sharing specifics on these changes because it doesn't want to provide threat actors insights that might help them circumvent these additional protections. Google also partnered with Japan's National Police Agency, Lumen Technologies, Human Security, Plume and Synthient to study and disrupt the botnet. The company said the dismantling of XCPE seriously impacted over a dozen malicious actors, yet warned that the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain.

   Conflicting Reports

   This article, citing TrendAI, states the botnet spanned more than 170 countries with the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and reports about 44,000 infected devices in the United States between June and October; theregister.com previously reported the devices spanned more than 200 countries without naming a country breakdown. The more detailed, attributed TrendAI figures and country ranking in this article should be treated as the more specific data point on geographic distribution.

6. theregister.com ↗ · pub. 02/11/2026 16:03 · coletado 02/11 17:00

   Google Dismantles XCPE Botnet of 1.3M+ Android TV Boxes After Tracing Backdoor to Maker Videostrong

   The Register's report adds that between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the XCPE operation, and confirms that Google has banned Videostrong from making devices with preloaded Google apps following the disruption (theregister.com).

   ler a análise desta fonte ocultar

   The Register's report adds that between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the XCPE operation, and confirms that Google has banned Videostrong from making devices with preloaded Google apps following the disruption (theregister.com).

   A coalition of private-sector security firms, including Google, Lumen, Human Security, Plume, Synthient and TrendAI, working with Japan's National Police Agency, disrupted XCPE, a backdoor used to build a botnet of more than 1.3 million Android devices across more than 200 countries. The Google Threat Intelligence Group (GTIG) assessed with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology, a Shenzhen-based hardware manufacturer that builds Android TV boxes and projectors. Videostrong allegedly embedded the backdoor in device firmware and sold access to criminal affiliates, who installed additional malware modules on devices shipped to unsuspecting customers, turning home internet connections into proxy networks for malicious traffic. Google has since cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps; Videostrong did not respond to inquiries.

   Technical Details

   The firmware's pre-installed management agent posed as a standard remote-management client, pulling updates from a GitHub page and connecting to an MQTT server that gave operators full remote control of each box, including the ability to install and remove apps, change settings, and push updates. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. The coalition also disrupted the command-and-control domains used to manage the affiliate modules; because these affiliates each have diversified distribution channels for their modules beyond XCPE, the takedown of their C2 domains is assessed to sever access to at least 10 million additional compromised devices. The operation is described as part of the same ecosystem as BadBox 2.0, another botnet that infected more than 10 million TV boxes and other devices before being disrupted by Human, Google and TrendAI in March 2025.

   Remediation

   Google has banned Videostrong from producing devices with preloaded Google apps following the disruption.

7. bleepingcomputer.com ↗ · pub. 02/11/2026 15:16 · coletado 02/11 17:00

   Google and Partners Dismantle XCPE Botnet of 1.3M+ Android TV Boxes Built by Videostrong

   This bleepingcomputer.com report adds technical detail to the known case: the backdoor's package names (x.cpe, com.oemservice), its command-and-control domain anyevonline[.]com and MQTT broker mqtt.szbboys[.]com, the evolution from the com.abc.nexus loader (introduced late 2024) to disguised droppers (since August 2026), and the specific criminal modules deployed through the backdoor, including residential proxy services Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer, and additional backdoors Moyu, Spirit and Bird. It also details Synthient's attribution evidence, including an open directory on file.anyevonline[.]com containing a PDF by Videostrong R&D director Owen Cao, and videostrong[.]cn sharing an IP with mqtt.anyevonline[.]com.

   ler a análise desta fonte ocultar

   This bleepingcomputer.com report adds technical detail to the known case: the backdoor's package names (x.cpe, com.oemservice), its command-and-control domain anyevonline[.]com and MQTT broker mqtt.szbboys[.]com, the evolution from the com.abc.nexus loader (introduced late 2024) to disguised droppers (since August 2026), and the specific criminal modules deployed through the backdoor, including residential proxy services Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer, and additional backdoors Moyu, Spirit and Bird. It also details Synthient's attribution evidence, including an open directory on file.anyevonline[.]com containing a PDF by Videostrong R&D director Owen Cao, and videostrong[.]cn sharing an IP with mqtt.anyevonline[.]com.

   Google and industry partners dismantled the XCPE Android malware botnet, which infected more than 1.3 million Android TV streaming boxes that Google says were intentionally backdoored by their manufacturer, Chinese company Videostrong Technology Co, to generate criminal revenue. Google attributes the campaign with high confidence to Videostrong, accusing it of deliberately embedding a persistent backdoor into devices it manufactured and selling access to criminal affiliates who deployed ad-fraud and residential-proxy modules. As part of the takedown, Google says it disabled XCPE command-and-control servers tied to more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices beyond the 1.3 million directly infected with the backdoor, including set-top boxes, karaoke machines and telehealth hardware. Google has also terminated Videostrong's certification to manufacture Android TV devices with preloaded Google apps and banned the company and future affiliates from producing certified Android devices.

   Technical Details

   The backdoor, tracked as x.cpe and com.oemservice, runs with Android system-level privileges and contacts a command-and-control server on the anyevonline[.]com domain, using different subdomains depending on the Android version and device type, to obtain credentials for an MQTT broker hosted at mqtt.szbboys[.]com used to receive commands. Through this channel, operators could silently install additional apps, disable Google Play Protect, execute shell commands with system privileges, capture screenshots, inject keystrokes, collect account and device information, and establish reverse shells. The devices also served as a platform for other criminal modules, including residential proxy services Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer, ad-fraud modules, and additional backdoors named Moyu, Spirit and Bird. In late 2024, Videostrong introduced a separate loader, com.abc.nexus, to run malicious modules while x.cpe focused on C2 communications, and since August 2026 began replacing it with smaller droppers disguised as system apps. Cybersecurity firm Synthient traced the backdoor to Videostrong after finding it preinstalled on a MECOOL KM9PRO Max box purchased in late 2025, discovering an open directory on file.anyevonline[.]com containing a PDF authored by Videostrong R&D director Owen Cao, and finding that Videostrong's videostrong[.]cn domain shared an IP address with mqtt.anyevonline[.]com, along with numerous Videostrong email addresses used to sign the backdoors.

   Remediation

   Google says the malware persists on infected devices even after the takedown, automatically reinstalling itself from the /oem/ partition if removed, so affected users need to flash clean firmware or disconnect the device from the internet to stop malicious activity. The disruption involved Japan's National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI, and Google says it has modified its device certification review process after finding Videostrong used obfuscation to evade security testing and load malicious code only after first boot.

8. helpnetsecurity.com ↗ · pub. 02/11/2026 12:50 · coletado 02/11 14:01

   Google Disrupts XCPE Botnet, Bans Videostrong Over Android TV Backdoor

   The article adds that Google estimates the takedown of affiliate command domains cuts off access to at least 10 million additional compromised devices beyond the 1.3 million directly tied to the XCPE backdoor, and details that since August 2026 operators have used droppers exploiting a privilege escalation flaw to write into the system partition, plus notes the backdoor wipes consent records and disables Play Protect by rewriting its verification setting. It also names Japan's National Police Agency as a partner in the takedown alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI, and includes a statement from HUMAN CISO Gavin Reid on the profit model behind compromised-device networks.

   ler a análise desta fonte ocultar

   The article adds that Google estimates the takedown of affiliate command domains cuts off access to at least 10 million additional compromised devices beyond the 1.3 million directly tied to the XCPE backdoor, and details that since August 2026 operators have used droppers exploiting a privilege escalation flaw to write into the system partition, plus notes the backdoor wipes consent records and disables Play Protect by rewriting its verification setting. It also names Japan's National Police Agency as a partner in the takedown alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI, and includes a statement from HUMAN CISO Gavin Reid on the profit model behind compromised-device networks.

   Google took down the server infrastructure behind XCPE, a backdoor embedded in the firmware of Android TV set-top boxes, and banned the manufacturer behind it, Videostrong Technology, from building certified Android devices. Google's Threat Intelligence Group attributes the operation with high confidence to Videostrong, which it says sold access to the backdoor to criminal affiliates who pushed their own modules onto victims' boxes. More than 1.3 million devices were enrolled in the botnet, most of them Android TV set-top boxes, though the backdoor also reached telehealth devices, karaoke machines, and digital signage. The affiliates used the access to run hidden ad views, enroll devices into residential proxy networks, steal account details and system logs, and deploy further malware, with operators also able to take live screenshots, inject keystrokes, and open a shell on infected devices.

   Technical Details

   The backdoor's main component runs with system privileges and reinstalls itself from a protected firmware partition after a reboot, so removing the app alone does not clear the device. It disables Google Play Protect by rewriting the package-verification setting and wipes records of what the user had consented to. Since August 2026, operators have deployed droppers disguised as system packages that exploit a privilege escalation flaw to write into the device's system partition, making the infection harder to dislodge. Google estimates that shutting down the command domains used by the criminal affiliates cuts off access to at least 10 million additional compromised devices, infected through other initial-access routes and other malware families, beyond the 1.3 million tied directly to this backdoor.

   Remediation

   Google took legal action against the domains and servers used to task the botnet and deliver modules, and against the command infrastructure of more than a dozen malware families carried through the backdoor. It banned Videostrong, along with any future subsidiaries and affiliates, from building certified Android devices or supplying software to certified vendors, and has tightened firmware integrity checks and its manufacturer review process for certified Android TV devices. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI supported the takedown effort.

9. thehackernews.com ↗ · pub. 02/11/2026 12:50 · coletado 02/11 14:00 primeiro registro

   Google Dismantles XCPE Botnet of 1.3M+ Android TV Boxes After Tracing Backdoor to Maker Videostrong

   ler a análise desta fonte ocultar

   Google led a takedown of a botnet called XCPE that infected more than 1.3 million Android devices, mostly TV set-top boxes, through a firmware backdoor named x.cpe. Google assesses with high confidence that Chinese manufacturer Videostrong Technology Co., based in Shenzhen, intentionally built the backdoor into many device models and brands, including its MECOOL line, over several years and sold criminal access to it rather than it resulting from a rogue insider or a mistake. Criminal affiliates used the backdoor to install modules that committed ad fraud and turned devices into residential proxies that relay other people's traffic through owners' home connections. Google took legal action to seize the domains and servers controlling the botnet, also disabling the command-and-control domains of more than a dozen malware families loaded through x.cpe, and banned Videostrong and any future affiliates from building or supplying certified Android devices.

   Technical Details

   The x.cpe backdoor runs as a system app inside the firmware with system-level access, reports to command-and-control servers, and disables Google Play Protect's app checks to install software silently. Through it, operators could install apps covertly, run commands, capture the screen, map the local network, take live screenshots, send keystrokes, exfiltrate account details, device information, app lists and system logs, and open reverse shells. Because x.cpe is embedded in the firmware, it reinstalls itself on reboot, and TrendAI (Trend Micro's enterprise unit) says cleanup requires vendor action, platform protection, or device replacement rather than user-side removal. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, with Malaysia, Brazil, Iraq, Mexico and Taiwan most affected, and roughly 26,000–42,000 devices each in the U.S., Germany, the U.K., Australia and Canada. Most infected devices are Android TV set-top boxes, but the backdoor also appeared on telehealth devices, karaoke machines and digital signage. Researchers linked Videostrong to the operation via its YokaTV Player app receiving settings from the backdoor's C2, a GitHub account named yf-videostrong hosting botnet packages, a document signed by Videostrong's R&D director found in an open server folder, and a Videostrong domain sharing an IP with the operators' control panel. Google says Videostrong hid malicious code to bypass a gap in its device certification tests and loaded it only after a device's first boot; as of November 2, Videostrong's website still advertised products as "Google Certified Android TV Box" and "Google Certified Android TV Stick."

   Remediation

   Because the backdoor cannot be removed by owners and persists across reboots, Synthient recommends organizations discard affected devices outright due to the high malware risk, while Plume recommends at minimum a full factory reset, though it does not confirm this removes x.cpe itself. Synthient advises organizations to use its published indicators to find MECOOL or similar devices on their networks, disconnect and discard any found, block the control domains and IP addresses it has listed, and keep other smart devices on separate network segments away from sensitive systems. TrendAI advises companies with remote staff to treat unmanaged consumer devices on home networks as part of their attack surface and to keep corporate access behind managed devices. Google has changed its device review process and is improving firmware checks for certified Android TV devices; it has also cut ties with and banned Videostrong from building or supplying certified Android devices.

Repetiram sem novidade

• darkreading.com — Google Discloses Takedown of 1.3 Million-Device XCPE Botnet Tied to Videostrong
• malwarebytes.com — Google Dismantles XCPE Backdoor Botnet Affecting 1.3 Million Videostrong-Made Android TV Boxes
• infosecurity-magazine.com — Google and Law Enforcement Partners Dismantle XCPE Botnet Built on Videostrong Backdoor in 1.3M+ Devices
• securityweek.com — Google Dismantles XCPE Botnet of 1.3 Million Android Set-Top Boxes Built by Videostrong