Google disrupts XCPE Android botnet of 1.3M TV boxes backdoored at the factory by Videostrong, bans the maker
Google and partners dismantled the XCPE botnet, made up of more than 1.3 million Android TV boxes whose firmware was backdoored during manufacturing. Google's Threat Intelligence Group (GTIG) attributes it with high confidence to the Chinese manufacturer Videostrong Technology Co, which allegedly sold access to criminal affiliates for ad fraud, residential proxy services and further malware installation. The disruption also took down C2 servers used by more than a dozen related malware families, cutting off at least 10 million other compromised devices (set-top boxes, karaoke machines, telehealth hardware, not all of them Android). Google revoked Videostrong's license to build Android TV devices with Google apps and banned it and its future affiliates from producing certified Android devices. The malware remains on infected devices and reinstalls itself if removed.
Detalhes técnicos
- The main backdoor, tracked as x.cpe and com.oemservice, runs with Android system privileges and is embedded in firmware. It has a modular architecture that separates backdoor functions from revenue-generating modules.
- At boot it contacts C2 on anyevonline[.]com (subdomains vary by Android version and device type) to get connection details and credentials for an MQTT broker (mqtt.szbboys[.]com), which is used to receive commands.
- Capabilities: silent app installation, disabling Google Play Protect, shell commands and scripts with system privileges, screenshots, keystroke injection, collection of account, device, app and log data, network reconnaissance and reverse shells.
- Modules monetized devices through residential proxy services (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer) and ad fraud (impressions, hidden pages, ad clicks). Some modules installed further backdoors: Moyu, Spirit and Bird.
- In late 2024 Videostrong introduced the loader com.abc.nexus. Since August 2026 it has been replaced with smaller droppers disguised as Android system apps.
- Synthient traced the backdoor to Videostrong from a MECOOL KM9PRO Max box bought in late 2025. It found an open directory on file.anyevonline[.]com containing backdoors and a PDF by Videostrong's R&D director. videostrong[.]cn resolved to the same IP as mqtt.anyevonline[.]com, and Videostrong email addresses were used to sign the backdoors.
- Videostrong used obfuscation to evade Google's certification testing and loaded malicious code after first boot. Google has changed its certification review process.
- Partners in the disruption: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Remediação
- The takedown did not clean infected devices: the malware reinstalls itself from the /oem/ partition if removed.
- Install clean firmware on affected devices, or disconnect them from the internet to stop malicious activity.
Linha do tempo
-
Google disrupts XCPE Android botnet of 1.3M TV boxes backdoored at the factory by Videostrong, bans the maker
ler a análise desta fonte ocultar
Google and partners dismantled the XCPE botnet, made up of more than 1.3 million Android TV boxes whose firmware was backdoored during manufacturing. Google's Threat Intelligence Group (GTIG) attributes it with high confidence to the Chinese manufacturer Videostrong Technology Co, which allegedly sold access to criminal affiliates for ad fraud, residential proxy services and further malware installation. The disruption also took down C2 servers used by more than a dozen related malware families, cutting off at least 10 million other compromised devices (set-top boxes, karaoke machines, telehealth hardware, not all of them Android). Google revoked Videostrong's license to build Android TV devices with Google apps and banned it and its future affiliates from producing certified Android devices. The malware remains on infected devices and reinstalls itself if removed.
Technical Details
- The main backdoor, tracked as x.cpe and com.oemservice, runs with Android system privileges and is embedded in firmware. It has a modular architecture that separates backdoor functions from revenue-generating modules.
- At boot it contacts C2 on anyevonline[.]com (subdomains vary by Android version and device type) to get connection details and credentials for an MQTT broker (mqtt.szbboys[.]com), which is used to receive commands.
- Capabilities: silent app installation, disabling Google Play Protect, shell commands and scripts with system privileges, screenshots, keystroke injection, collection of account, device, app and log data, network reconnaissance and reverse shells.
- Modules monetized devices through residential proxy services (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer) and ad fraud (impressions, hidden pages, ad clicks). Some modules installed further backdoors: Moyu, Spirit and Bird.
- In late 2024 Videostrong introduced the loader com.abc.nexus. Since August 2026 it has been replaced with smaller droppers disguised as Android system apps.
- Synthient traced the backdoor to Videostrong from a MECOOL KM9PRO Max box bought in late 2025. It found an open directory on file.anyevonline[.]com containing backdoors and a PDF by Videostrong's R&D director. videostrong[.]cn resolved to the same IP as mqtt.anyevonline[.]com, and Videostrong email addresses were used to sign the backdoors.
- Videostrong used obfuscation to evade Google's certification testing and loaded malicious code after first boot. Google has changed its certification review process.
- Partners in the disruption: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Remediation
- The takedown did not clean infected devices: the malware reinstalls itself from the /oem/ partition if removed.
- Install clean firmware on affected devices, or disconnect them from the internet to stop malicious activity.