Google dismantles 1.3 million-device Android botnet, bans TV box maker

Google and industry partners have disrupted XCPE, a botnet comprising more than 1.3 million devices, predominantly Android TV boxes.

Google alleges that device manufacturer Videostrong deliberately installed the backdoor to profit from malware distribution, advertising fraud, and residential proxy services.

Google has cut ties with the company and banned it, along with future subsidiaries and affiliates, from producing certified Android devices or supplying software to other certified vendors.

The investigation involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google pursued legal action against infrastructure controlling both XCPE and more than a dozen malware families distributed through it.

Videostrong manufactures Android hardware and develops devices for other brands. Synthient’s accompanying investigation links the operation to MECOOL-branded products and the YOKATV storefront, providing a consumer-facing connection to the underlying manufacturer.

Backdoors built into the firmware

Google found the malicious software embedded in multiple device models and brands over several years. Although most infections involved TV boxes, researchers also identified compromised telehealth equipment, karaoke machines, and digital signage devices.

The primary backdoor, called x.cpe or com.oemservice, runs with Android system privileges. A firmware component reinstalls it after reboot if its installed package is removed, making ordinary uninstallation ineffective.

After contacting its infrastructure, the malware establishes a persistent connection through MQTT, a lightweight messaging protocol, to receive instructions and configuration updates.

Its capabilities include silently installing applications, executing shell commands, capturing screenshots, injecting keystrokes, and conducting network reconnaissance. Google also observed operators stealing account and device information, collecting system logs, and establishing reverse shells.

The backdoor can disable Google Play Protect’s app verification. Google says Videostrong used obfuscation and delayed malicious code loading until after first boot to evade its certification checks, prompting changes to the review process.

Turning purchases into recurring revenue

XCPE distributes affiliate modules that turn devices into residential proxy exit nodes, generate fraudulent advertising activity, or install further backdoors.

Residential proxies route customers’ traffic through other people’s internet connections. In this operation, devices were enrolled without their owners’ knowledge or consent, potentially making malicious activity appear to originate from victims’ networks.

Google identified modules associated with services including Linkfog, AppSalt/Honeygain, NetNut, and Traffmonetizer. Some devices ran as many as three residential proxy SDKs simultaneously.

Synthient examined a MECOOL KM9PRO Max and traced infrastructure links, signing email addresses, and a document signed by Videostrong’s R&D director to support its attribution. It estimates that approximately 500,000 compromised devices were actively online, with substantial concentrations in Malaysia, Mexico, and Brazil.

Google assesses that disrupting affiliate infrastructure will also sever access to at least 10 million additional compromised devices reached through distribution channels beyond XCPE. However, this estimate does not mean those devices have been cleaned.

Consumers with identified affected devices should disconnect them. Synthient recommends retiring the compromised hardware because additional malware may remain. Google advises buying connected devices from reputable manufacturers and keeping built-in security protections enabled.