Google and industry partners have dismantled a botnet that enrolled more than 1.3 million Android set-top boxes and other connected devices, alleging that Shenzhen-based manufacturer Videostrong Technology deliberately built the underlying backdoor into device firmware for profit. The operation, dubbed XCPE, was disrupted last week in a campaign involving Google, Lumen, HUMAN Security, Plume, Synthient, TrendAI and Japan’s National Police Agency, according to Google Threat Intelligence Group. [1]
Google said it assesses with high confidence that Videostrong developed, deployed and operated XCPE, then sold access to criminal affiliates that loaded monetization modules onto unsuspecting customers’ devices. Most victims were using Android TV boxes, but investigators also found infected telehealth equipment, karaoke machines and digital-signage systems. The devices were built across multiple brands and models over several years, and Google did not publish a complete list of affected products.
The backdoor runs with Android system-level privileges and can reinstall itself from the firmware’s /oem/ partition after a user removes it and reboots the device. Its operators used HTTP to bootstrap configuration before maintaining command-and-control through MQTT, enabling silent application installation, arbitrary shell commands, screen capture, keystroke injection, network reconnaissance and data theft. Google’s analysis found modules that converted devices into residential proxy nodes or used them for advertising fraud, while some components could install still more malware.
The takedown targeted Videostrong’s infrastructure as well as command-and-control domains used by more than a dozen affiliate malware families. Google estimates that disrupting those domains could sever access to at least 10 million additional compromised devices distributed through channels beyond XCPE, although that figure is an assessment rather than a confirmed infection count. TrendAI separately observed more than 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1.
Google has cut ties with Videostrong, barred the company and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it is strengthening firmware-integrity reviews. The company’s report identifies no CVE, CVSS rating, public proof-of-concept exploit or vendor patch for XCPE, and does not classify the activity under a formal exploitation-in-the-wild program. Because the backdoor can survive ordinary removal, owners of suspicious or uncertified Android TV boxes should isolate them from home networks, avoid using them for sensitive accounts and seek a manufacturer-supported firmware replacement; where that is unavailable, replacing the device is the safer option. Google also advises consumers to buy connected devices from reputable manufacturers and keep protections such as Play Protect enabled. The campaign overlaps with the wider BadBox ecosystem, but Google’s report does not specifically establish that XCPE is BadBox 2.0.
