Google dismantles 1.3-million-device Android TV botnet

The Google Threat Intelligence Group (GTIG) announced this week the dismantling of the XCPE botnet, a network of over 1.3 million compromised Android TV devices. Unlike traditional botnets where hackers exploit security flaws in legitimate devices, Google attributes with high confidence that Chinese manufacturer Videostrong Technology Co. installed a backdoor directly in the firmware of devices it manufactured — and kept it running as a long-term criminal infrastructure.

The case is a rare and disturbing example of pre-installed malware in consumer hardware: this is not an exploit exploited after sale, but a malicious component embedded in the production line, designed to generate recurring revenue for its operators even after the device is purchased by the consumer.

The XCPE architecture

Since late 2024, the XCPE botnet evolved from a simple dropper into a three-stage modular architecture. The main component, tracked as `x.cpe` and `com.oemservice`, runs with system privileges on Android and serves as the command and control (C2) communicator. It transfers execution of malicious modules to an external loader, `com.abc.nexus`, which in turn employs sophisticated anti-analysis utilities to evade detection by security sandboxes.

The command and control process is particularly refined: first, the malware makes HTTP POST requests to fetch dynamic configuration, geolocation data, and STUN server parameters. It then establishes a persistent, real-time MQTT connection to receive instructions — from silent app installation to shell command execution and screen captures — all running under system UID.

The most recent evolution of the malware removed malicious modules from `x.cpe` itself and began using separate packages disguised as Android system applications — with names like `com.android.system.ntp` and `com.android.sso.auth.handler` — installed directly in `/system/priv-app/`, bypassing Android's usual protections.

Large-scale monetization

The XCPE botnet was not built for espionage or direct attack: it was designed for profit. The observed monetization modules include:

- Ad fraud: malicious applications generated fake clicks and impressions, draining advertiser budgets. - Residential proxy: compromised devices were integrated into residential proxy networks via the GaGaNode SDK, owned by operator IPCola. Each infected device became a network node, allowing criminals to mask their malicious traffic behind legitimate residential IP addresses. - Additional malware loading: XCPE served as a platform for installing other backdoors, including the Moyu, Spirit, and Bird variants, which in turn loaded even more malicious modules.

The most alarming finding: Google assessed that by disabling the XCPE command and control domains, the action also cut off access for at least 10 million other devices compromised by the same criminal affiliates — suggesting XCPE was one of the largest malware distributors for IoT of the modern era.

How the malware passed Android's tests

Google requires manufacturers to pass a comprehensive suite of compatibility and security tests to obtain Android certification with preloaded Google apps. Videostrong, however, employed obfuscation techniques to exploit a gap in Google's testing: the malicious code was loaded after the device's first boot, bypassing initial checks. This means devices were certified as "safe" and delivered to consumers before the malware ever activated.

Google had already taken action against hardware botnets, including legal action against the BadBox campaign in 2024. Videostrong's response to regulatory pressure appears to have been simply to refine the malware's architecture rather than abandon the practice.

Response and implications

Google has severed ties with Videostrong, revoked its license to manufacture Android TV devices, and will ban the company and its future affiliates from producing certified Android devices or supplying software to other certified vendors. The action was carried out in collaboration with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

But the broader question remains: is Android TV open enough that low-caliber manufacturers can insert malware into certification? Google's response — altering the review process to ensure firmware integrity after first boot — is necessary but insufficient. The XCPE case shows that IoT security goes far beyond post-sale patches: it must be built from the factory, in development and certification processes.

With 1.3 million devices already compromised and over 10 million potentially affected by the same affiliates, XCPE is a reminder that the frontier of cybersecurity is not only in the cloud or in servers — it is also, increasingly, inside the streaming box on your couch.

Sources: Google Cloud Blog, Bleeping Computer, The Verge

✓ Independent sources cross-checked and verified before publishing