Malware from the firmware up
The XCPE botnet operated on more than 1.3 million Android TV set-top boxes across more than 170 countries. Unlike the pattern seen in most IoT attacks -- where network vulnerabilities or user-installed malware are the primary vector -- XCPE was embedded directly into the firmware partition during manufacturing, making it virtually impossible for users to remove. The primary component, tracked as `x.cpe` or `com.oemservice`, ran at `android.uid.system` privileges and would automatically reinstall itself from the `/oem/` partition on every reboot if uninstalled.
The Google Threat Intelligence Group (GTIG) attributed with high confidence the creation and operation of the backdoor to Videostrong Technology Co., a Shenzhen-based Chinese manufacturer that operates as both OEM and ODM for Android devices. What made this case exceptional was not the technical sophistication -- though the malware's modular architecture was noteworthy -- but the fact that it was deliberately developed and deployed for financial gain. Google explicitly stated it did "not believe this campaign was an isolated rogue insider or a development oversight."
A business model built on compromised hardware
Videostrong didn't operate the botnet alone. The company sold backdoor access to criminal affiliates, who then injected their own malware modules into compromised devices. This cascading model turned every consumer-grade TV box into a distribution point for illicit activities. Modules observed on the XCPE network included: residential proxy software (Linkfog, AppSalt, GaGaNode, NetNut, Traffmonetizer) that routed third-party traffic through users' home connections; ad fraud engines (CBOXTV, HiddenView) generating fake impressions and clicks in the background; and additional backdoors (Moyu, Spirit, Bird) that enabled on-demand installation of further malware.
The communication system used a two-stage protocol: initial HTTP requests to fetch dynamic configuration and geolocation data, followed by persistent MQTT connections for real-time command reception. Through the MQTT broker, operators could silently install applications, execute system-level shell commands, capture screenshots, inject keystrokes, harvest account data and system logs, and perform network reconnaissance. Notably, the malware employed `libseccomp_guard.so`, a sophisticated anti-analysis utility that prevented malicious modules from being detected by automated sandboxes.
The scale of the compromise
One of the most striking aspects of the case was Google's estimate: dismantling the affiliates' C2 domains would cut off access to at least 10 million additional devices compromised by malware distributed through other channels. This meant XCPE functioned as a distribution platform -- a kind of "malware-as-a-service" for IoT devices. Google also took down servers used by over a dozen malware families that leveraged the XCPE backdoor as a secondary command and control channel.
Google took concrete measures against Videostrong: banned the company and its future subsidiaries from building certified Android devices and from supplying software to certified vendors. The company also acknowledged that Videostrong exploited a gap in Android's security testing by loading malicious code after the device's first boot, thus bypassing compatibility checks. Google says it has since implemented changes to its review process to prevent similar gaps in the future.
Partners in the disruption effort included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Synthient, in particular, conducted the forensic tracing that linked the backdoor to Videostrong, discovering a publicly accessible directory on the `file.anyevonline[.]com` server that contained backdoors and even a PDF signed by Owen Cao, Videostrong's R&D director.
What this means for the Android ecosystem
The XCPE case fits into the same ecosystem as BadBox 2.0, another TV box botnet dismantled in March 2025 by Human, Google, and TrendAI. Both cases share characteristics: IoT devices with permanent connectivity, rare or nonexistent updates, and consumers largely unaware of what runs on their hardware. The difference is that XCPE didn't just infect devices -- it was manufactured as malware from the start, as an integral part of the product.
Google published a list of 182 device models known to be part of the botnet. Owners of MECOOL boxes or white-label brands purchased from unknown manufacturers should consult it. Even so, there's an important caveat: while the malware is now inactive, it remains installed as a system app and cannot be easily removed by average users, especially since Play Protect remains disabled on compromised devices.
The question is not whether the next TV box botnet will emerge -- it's only a matter of when -- but whether Android's device certification model, designed to ensure compatibility and security, is truly prepared to detect manufacturers that embed malware during manufacturing rather than exploiting vulnerabilities after the fact. XCPE didn't break Android: it was built to run inside it, in its firmware, before the user even flipped the switch.
Sources: Google Threat Intelligence Group, BleepingComputer, CyberScoop
✓ Independent sources cross-checked and verified before publishing
