EN PT-BR
← Voltar ao feed
high consumer electronics healthcare advertising

Google Dismantles XCPE Botnet: Videostrong Firmware Backdoor Infected 1.3M+ Android TV Devices

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 02:11 · coletado há 1 hora

Google Threat Intelligence Group (GTIG) and partners disrupted the XCPE botnet, a firmware-level backdoor preinstalled on more than 1.3 million Android set-top boxes. GTIG assesses with high confidence that Android OEM/ODM Videostrong Technology Co. deliberately built and operated it for profit, and sold access to criminal affiliates. Affiliate modules performed ad fraud, turned devices into residential proxy exit nodes and installed further malware. Google also disrupted C2 domains of more than a dozen affiliate malware families, expecting to cut access to at least 10 million additional compromised devices. It pursued legal action against Videostrong's domains and servers and banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1 (a lower bound), with the highest counts in Malaysia, Brazil, Iraq, Mexico and Taiwan.

Detalhes técnicos

  • Modular design since at least late 2024. The primary backdoor x.cpe (sometimes com.oemservice) is preloaded in firmware, runs as android.uid.system and reinstalls from the /oem/ partition at reboot if removed.
  • Loader com.abc.nexus handles anti-analysis and module execution. Since August 2026 operators mass uninstalled it and pushed single-module droppers disguised as system apps such as com.android.system.ntp.
  • Monetization modules include proxy SDKs (Linkfog, AppSalt, NetNut, GaGaNode) and ad-fraud tools (CBOXTV, HiddenView). Some devices ran up to three proxy SDKs at once. The Popanet component matches malware from Google's earlier NetNut disruption.
  • Two-stage C2: an HTTP POST with AES-encrypted hardware telemetry retrieves configuration, then a persistent MQTT connection to the broker mqtt.szbboys[.]com. Operators can silently install apps, run shell commands, capture screens, inject keystrokes, map victim networks, open reverse shells and exfiltrate account data, package inventories and logs.
  • Defense evasion: Google Play Protect is disabled by setting package_verifier_user_consent to -1, and the loader drops libseccomp_guard.so to hinder sandboxing and instrumentation.
  • Some variants use libexploit.so to restart adbd with root, remount the system partition read-write and copy themselves into /system/priv-app/. The property persist.networkstack.uninstall lets operators manage cleanup.
  • Videostrong exploited a gap in Google's compatibility testing by loading malicious code after the initial boot. Google has since revised its review process and firmware integrity checks for certified Android TV devices.
  • Videostrong removed malicious modules from x.cpe in late 2024, possibly in response to enforcement against BADBOX.
  • Besides set-top boxes, the backdoor was found on telehealth devices, karaoke machines and digital signage.
  • Investigation partners: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Remediação

  • Owners cannot remove the implant themselves; cleanup requires vendor action, platform protection or device replacement. Plume recommends a full factory reset because modules may have planted extra backdoors, but does not say a reset removes x.cpe.
  • Replace affected set-top boxes and avoid uncertified or off-brand Android TV hardware.
  • Isolate smart devices on a guest network or separate segment.
  • Block and monitor traffic to szbboys[.]com and anyevonline[.]com, and block broker IPs 219.134.163[.]210 and 219.134.163[.]211.
  • Watch for unexpected MQTT or proxy traffic from streaming devices.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 02:11 · coletado 03/11 04:00 primeiro registro

    Google Dismantles XCPE Botnet: Videostrong Firmware Backdoor Infected 1.3M+ Android TV Devices

    ler a análise desta fonte

    Google Threat Intelligence Group (GTIG) and partners disrupted the XCPE botnet, a firmware-level backdoor preinstalled on more than 1.3 million Android set-top boxes. GTIG assesses with high confidence that Android OEM/ODM Videostrong Technology Co. deliberately built and operated it for profit, and sold access to criminal affiliates. Affiliate modules performed ad fraud, turned devices into residential proxy exit nodes and installed further malware. Google also disrupted C2 domains of more than a dozen affiliate malware families, expecting to cut access to at least 10 million additional compromised devices. It pursued legal action against Videostrong's domains and servers and banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1 (a lower bound), with the highest counts in Malaysia, Brazil, Iraq, Mexico and Taiwan.

    Technical Details

    • Modular design since at least late 2024. The primary backdoor x.cpe (sometimes com.oemservice) is preloaded in firmware, runs as android.uid.system and reinstalls from the /oem/ partition at reboot if removed.
    • Loader com.abc.nexus handles anti-analysis and module execution. Since August 2026 operators mass uninstalled it and pushed single-module droppers disguised as system apps such as com.android.system.ntp.
    • Monetization modules include proxy SDKs (Linkfog, AppSalt, NetNut, GaGaNode) and ad-fraud tools (CBOXTV, HiddenView). Some devices ran up to three proxy SDKs at once. The Popanet component matches malware from Google's earlier NetNut disruption.
    • Two-stage C2: an HTTP POST with AES-encrypted hardware telemetry retrieves configuration, then a persistent MQTT connection to the broker mqtt.szbboys[.]com. Operators can silently install apps, run shell commands, capture screens, inject keystrokes, map victim networks, open reverse shells and exfiltrate account data, package inventories and logs.
    • Defense evasion: Google Play Protect is disabled by setting package_verifier_user_consent to -1, and the loader drops libseccomp_guard.so to hinder sandboxing and instrumentation.
    • Some variants use libexploit.so to restart adbd with root, remount the system partition read-write and copy themselves into /system/priv-app/. The property persist.networkstack.uninstall lets operators manage cleanup.
    • Videostrong exploited a gap in Google's compatibility testing by loading malicious code after the initial boot. Google has since revised its review process and firmware integrity checks for certified Android TV devices.
    • Videostrong removed malicious modules from x.cpe in late 2024, possibly in response to enforcement against BADBOX.
    • Besides set-top boxes, the backdoor was found on telehealth devices, karaoke machines and digital signage.
    • Investigation partners: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

    Remediation

    • Owners cannot remove the implant themselves; cleanup requires vendor action, platform protection or device replacement. Plume recommends a full factory reset because modules may have planted extra backdoors, but does not say a reset removes x.cpe.
    • Replace affected set-top boxes and avoid uncertified or off-brand Android TV hardware.
    • Isolate smart devices on a guest network or separate segment.
    • Block and monitor traffic to szbboys[.]com and anyevonline[.]com, and block broker IPs 219.134.163[.]210 and 219.134.163[.]211.
    • Watch for unexpected MQTT or proxy traffic from streaming devices.