Google disrupts 1.3M-device Android botnet and blames TV box maker Videostrong for x.cpe firmware backdoor
1 fonte(s)
·
1 atualização(ões)
·
publicado 02/11/2026 12:50
·
coletado há 1 hora
Google led a takedown in late October 2026 of a botnet of more than 1.3 million Android devices, mostly TV set-top boxes. Google says it is highly confident that Shenzhen-based maker Videostrong intentionally built the x.cpe backdoor into its firmware and sold access to criminals. The operators used the boxes for ad fraud and as residential proxies. Google used legal action to take down the botnet's C2 domains and servers, plus the control domains of more than a dozen malware families loaded through the backdoor, and banned Videostrong from building or selling certified Android devices. The backdoor remains on devices in the field, and owners cannot remove it themselves.
Detalhes técnicos
- x.cpe runs as a system app inside the firmware, signed with the maker's key and with system-level access. It reports to C2 servers and waits for orders. To install software silently, it first disables app checks in Google Play Protect.
- Capabilities: silent app installation, command execution, screen capture and network mapping. Google observed live screenshots, keystroke injection, theft of account details, device information, app lists and system logs, and reverse shells.
- Most modules turned the boxes into residential proxies or sold their bandwidth. Others faked online ad views.
- Because x.cpe is part of the firmware, it reinstalls itself on restart, so removal does not persist.
- Attribution to Videostrong rests on several points:
- x.cpe passes C2 settings to other Videostrong apps, including the YokaTV Player streaming app.
- A GitHub account hosting botnet packages is named yf-videostrong.
- Synthient found a document signed by Videostrong's R&D director in an open folder on a botnet server.
- A Videostrong web domain shares an IP address with the operators' control panel.
- Plume found that Videostrong supplies both the firmware and the remote management tools.
- Google says Videostrong hid its code to bypass a gap in its compatibility and security tests and loaded the malicious code after first boot. Google has changed its review process.
- TrendAI (Trend Micro) counted 1,472,554 infected devices across 206 models between June 3 and October 1, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan. The US, Germany, UK, Australia and Canada each had about 26,000 to 42,000.
- Synthient published a list of 182 device model names (a model name alone does not confirm infection). Its report focuses on MECOOL-branded boxes, and a purchased MECOOL KM9PRO Max had the backdoor preinstalled.
- Plume found more than a dozen devices, mostly MECOOL, using the C2 server. It reports that both Google-certified and AOSP devices were affected.
- Besides TV boxes, the backdoor also appeared on telehealth devices, karaoke machines and digital signage.
- Google expects the action to cut off access to at least 10 million more infected devices, but warns that operators switch tools quickly.
- Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI assisted in the operation.
Remediação
- Plume recommends a full factory reset, but does not say whether it removes x.cpe itself. Synthient advises discarding affected boxes.
- Organizations should use Synthient's published indicators to find MECOOL or similar devices, disconnect and discard any found, and block the listed C2 domains and IPs.
- Keep smart devices on separate network segments away from sensitive systems.
- TrendAI advises treating unmanaged consumer devices on remote staff's home networks as part of the attack surface and keeping corporate access behind managed devices.
- TrendAI says cleanup needs vendor action, platform protection or device replacement.
Linha do tempo
-
Google disrupts 1.3M-device Android botnet and blames TV box maker Videostrong for x.cpe firmware backdoor
ler a análise desta fonte ocultar
Google led a takedown in late October 2026 of a botnet of more than 1.3 million Android devices, mostly TV set-top boxes. Google says it is highly confident that Shenzhen-based maker Videostrong intentionally built the x.cpe backdoor into its firmware and sold access to criminals. The operators used the boxes for ad fraud and as residential proxies. Google used legal action to take down the botnet's C2 domains and servers, plus the control domains of more than a dozen malware families loaded through the backdoor, and banned Videostrong from building or selling certified Android devices. The backdoor remains on devices in the field, and owners cannot remove it themselves.
Technical Details
- x.cpe runs as a system app inside the firmware, signed with the maker's key and with system-level access. It reports to C2 servers and waits for orders. To install software silently, it first disables app checks in Google Play Protect.
- Capabilities: silent app installation, command execution, screen capture and network mapping. Google observed live screenshots, keystroke injection, theft of account details, device information, app lists and system logs, and reverse shells.
- Most modules turned the boxes into residential proxies or sold their bandwidth. Others faked online ad views.
- Because x.cpe is part of the firmware, it reinstalls itself on restart, so removal does not persist.
- Attribution to Videostrong rests on several points:
- x.cpe passes C2 settings to other Videostrong apps, including the YokaTV Player streaming app.
- A GitHub account hosting botnet packages is named yf-videostrong.
- Synthient found a document signed by Videostrong's R&D director in an open folder on a botnet server.
- A Videostrong web domain shares an IP address with the operators' control panel.
- Plume found that Videostrong supplies both the firmware and the remote management tools.
- Google says Videostrong hid its code to bypass a gap in its compatibility and security tests and loaded the malicious code after first boot. Google has changed its review process.
- TrendAI (Trend Micro) counted 1,472,554 infected devices across 206 models between June 3 and October 1, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan. The US, Germany, UK, Australia and Canada each had about 26,000 to 42,000.
- Synthient published a list of 182 device model names (a model name alone does not confirm infection). Its report focuses on MECOOL-branded boxes, and a purchased MECOOL KM9PRO Max had the backdoor preinstalled.
- Plume found more than a dozen devices, mostly MECOOL, using the C2 server. It reports that both Google-certified and AOSP devices were affected.
- Besides TV boxes, the backdoor also appeared on telehealth devices, karaoke machines and digital signage.
- Google expects the action to cut off access to at least 10 million more infected devices, but warns that operators switch tools quickly.
- Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI assisted in the operation.
Remediation
- Plume recommends a full factory reset, but does not say whether it removes x.cpe itself. Synthient advises discarding affected boxes.
- Organizations should use Synthient's published indicators to find MECOOL or similar devices, disconnect and discard any found, and block the listed C2 domains and IPs.
- Keep smart devices on separate network segments away from sensitive systems.
- TrendAI advises treating unmanaged consumer devices on remote staff's home networks as part of the attack surface and keeping corporate access behind managed devices.
- TrendAI says cleanup needs vendor action, platform protection or device replacement.