Google Dismantles 1.3 Million TV Box Botnet; Factory Backdoor Remains
Google and partners dismantled the XCPE botnet of more than 1.3 million Android TV set-top boxes and took down its command servers. Google says Chinese manufacturer Videostrong shipped the x.cpe backdoor in factory firmware and sold access to criminals, who used the boxes as residential proxies and for ad fraud. The backdoor remains in firmware, reinstalls after restart and cannot be removed by owners; affected devices, seen in 182 models, should be replaced.
What happened
Google and partners, including Japan's National Police Agency, dismantled the XCPE botnet, made up of more than 1.3 million Android set-top boxes. Google says Chinese manufacturer Videostrong built a backdoor into the devices from the factory and sold access to criminals. The command servers are down, but the backdoor remains on the devices.
Why it matters
Without owners' knowledge, the boxes were rented out as residential proxies and used for ad fraud; the backdoor also captured screenshots, recorded keystrokes, and extracted account details. Anyone running these TV boxes at home or at work remains exposed, since the backdoor cannot be removed. Google estimates the action severed criminals' control over at least 10 million additional compromised devices.
What to do
Identify and unplug low-cost Android set-top boxes, especially models tied to Videostrong and the MECOOL brand (Skyworth); Synthient published a list of affected models. Replace affected devices, as the backdoor reinstalls after reboot. Review future purchases of Android devices from uncertified makers.
For the technical team
- Affected
- Videostrong Technology Set-top boxes Android TV da fabricante chinesa Videostrong, com backdoor XCPE (x.cpe) embutido no firmware; 1,3 milhão de dispositivos formavam botnet usada como proxies residenciais e para fraude; ou · Videostrong (OEM/ODM) Android set-top boxes: more than 1.3 million devices, 182 models, spread across more than 200 countries. The same malware appears in Android-based telehealth devices, karaoke machines, and digital signage. MECOOL boxes, sold by Skyworth, also bundled Videostrong's malware, according to Synthient.
- Exploitation
- Botnet active for years and operated by the manufacturer itself. Google (GTIG) states with high confidence that the backdoor was intentional and access was sold to criminal affiliates. Synthient's founder calls the 1.3 million figure 'highly conservative' and says the true scale is likely far higher.
- Fix
- No fix on the device: the backdoor reinstalls from the /oem/ partition after reboot and cannot be removed by the owner; hardware replacement is required. Google severed ties with Videostrong, banned the company from devices with preloaded Google apps, and closed the testing gap.
- Vector
- x.cpe backdoor pre-installed in firmware by the manufacturer, persisting on the /oem/ partition, running with android.uid.system privilege. On startup it contacts the C2 over MQTT and runs affiliate commands: shell scripts, silent app installs, disabling Google Play Protect, screen capture, keystroke recording, and remote shells. Videostrong used obfuscation to exploit a gap in Google's compatibility tests and load the code after first boot; Google says it has since closed that gap.
- More details
- Three-stage architecture: primary backdoor on /oem/, loader and execution engine, and affiliate monetization modules. The takedown involved Japan's National Police Agency, Lumen, Human Security, Plume, Synthient, and TrendAI; the legal action took down Videostrong's domains and servers plus the C2 used to install over a dozen malware families. Technical reports published by Plume, Synthient, and TrendAI; Synthient lists affected devices by model number.
Indicators (IoCs)
- XCPE (x.cpe)
- /oem/ partition
- NetNut
- EarnFM
- Traffmonetizer
- Jaguar
- LINKFOG
- BMW/IPWeb
- GaGaNode
- Grass
Timeline
Google says most infected devices are set-top boxes, but the X.CPE botnet also reached other Android devices, including telehealth equipment, karaoke machines and digital signage.
Police and tech firms joined Google in the operation to dismantle the XCPE botnet attributed to Chinese device maker Videostrong.
SecurityWeek coverage reinforces that the XCPE botnet was created and operated for financial gain by manufacturer Videostrong.
Want the next updates in your inbox? Get the daily edition →
See all 12 updates
Krebs details the takedown: Google severed ties with manufacturer Videostrong, and the action is expected to cut the botnet's access to more than 10 million additional systems, including Android-based healthcare devices and karaoke machines.
Google says Videostrong itself built the backdoor and sold the access to criminals; the maker was banned from certified Android and the takedown cuts off at least 10 million more infected devices.
Google says Videostrong embedded the backdoor at the factory and that devices across more than 200 countries were used as residential proxies, for ad fraud, data theft and malware delivery; the command-and-control infrastructure was seized.
Google says with high confidence that Videostrong deliberately built the x.cpe backdoor into its firmware and sold access to criminal affiliates; the takedown removed the maker's domains and servers plus command infrastructure for 12+ malware families.
BleepingComputer highlights Google's disruption of the million-device XCPE botnet and the ban on the TV box maker.
Google says it is highly confident Videostrong intentionally embedded the backdoor and sold access to criminals, who used the boxes for ad fraud and to route other people's traffic through owners' home internet.
Researchers detail that the x.cpe backdoor reinstalls after a restart, cannot be removed by owners and has been identified in 182 device models.
Google says the backdoor went beyond ad fraud: it captured screenshots, logged keystrokes, extracted account details, opened remote shells, and disabled Google Play Protect to silently install malware.
Google announces the botnet control server takedown and bans Videostrong.
Sources 10 sources
- @TheHackersNews @TheHackersNews
- @TheHackersNews @TheHackersNews
- @TheHackersNews @TheHackersNews
- Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access The Hacker News
- @BleepinComputer @BleepinComputer
See all 12 sources
- @DailyDarkWeb @DailyDarkWeb
- @DarkWebInformer @DarkWebInformer
- @IntCyberDigest @IntCyberDigest
- Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies Krebs on Security
- Google Dismantles XCPE Botnet of 1.3 Million Android Devices SecurityWeek
- Police and Tech Firms Team Up to Dismantle XCPE Botnet Infosecurity Magazine
- Google dismantles massive botnet hidden in Android TV boxes The Record
