Google and Partners Disrupt XCPE Botnet Affecting 1.3 Million Set-Top Boxes

Nov 2, 2026 · Original article ↗

Summary

Google and partners say they disrupted the XCPE backdoor, which enrolled more than 1.3 million set-top boxes. Mandiant details its persistence, MQTT command channel and affiliate modules used for ad fraud, proxying and additional malware.

Key points

Google assesses with high confidence that Videostrong intentionally developed and operated XCPE for financial gain, selling affiliate access to infected devices.
The backdoor was preloaded in device firmware with system-level privileges and could reinstall itself after removal from the app directory.
XCPE used HTTP for initial configuration and persistent MQTT connections for commands, including silent app installs, shell execution, screen capture and network reconnaissance.
Google and partners found affiliate modules that turned devices into residential proxy nodes, performed ad fraud or loaded additional malware; operators were also observed exfiltrating device and account information.
Google says the botnet enrolled more than 1.3 million set-top boxes; it also expects disruption of affiliate command-and-control domains to sever access to at least 10 million additional compromised devices.
Google took legal action against control and affiliate command-and-control infrastructure, banned Videostrong from supplying certified Android devices, and changed its firmware review process.
Since August 2026, newer dropper packages have reportedly used root ADB access to install themselves in the system partition and deploy individual monetization modules.

Article Details

Attack Vectors: XCPE was preloaded in device firmware with system-level privileges and reinstalled from the /oem/ partition after reboot if removed from /data/app/.
The backdoor fetched configuration over HTTP, then used persistent MQTT connections to receive commands, install applications, download modules, and execute shell commands or scripts.
Operators loaded affiliate modules that used infected devices for residential proxy traffic, ad fraud, and additional backdoor activity.
The malware disabled Google Play Protect app verification, used anti-analysis protections, and disguised newer droppers as Android system applications.
Defensive Notes: Keep Google Play Protect and built-in device security protections enabled; review permissions for third-party VPN and proxy applications.
Use trusted app stores and buy connected devices from reputable manufacturers.
The article recommends independent security audits of device manufacturers and stronger firmware-integrity checks. Google reports that it changed its review process and took legal action to disrupt XCPE infrastructure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`intermedia-arts[.]tv`	Fallback command-and-control domain for system packages.
DOMAIN	`mqtt[.]szbboys[.]com`	MQTT command-and-control broker used by XCPE samples.
DOMAIN	`ott[.]szbboys[.]com`	XCPE infrastructure used for file upload and download and OTA updates.
DOMAIN	`szbboys[.]com`	Domain identified as hosting core XCPE command-and-control infrastructure.
IPV4	`219[.]134[.]163[.]210`	Host identified as an MQTT command-and-control broker for XCPE.
IPV4	`219[.]134[.]163[.]211`	Host identified as an MQTT command-and-control broker for XCPE.
IPV4	`23[.]94[.]49[.]57`	Operator server used for file hosting and command-and-control.
IPV4	`38[.]145[.]197[.]135`	Operator server hosting anyevonline infrastructure and files.
SHA256	`1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960`	Malicious com.abc.nexus sample hash listed in the article.
SHA256	`350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4`	Malicious com.oemservice sample hash listed in the article.
SHA256	`3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18`	Representative XCPE malware sample hash listed in the article.
SHA256	`42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135`	Hash of libexploit.so, a privilege-escalation component bundled with the sso.authHandler dropper.
SHA256	`7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42`	Hash of libnative_keys.so, identified as key storage for the AppSalt SDK bundled with the malware.
SHA256	`8cb62b3a9b74ca8b907aef7d83fee65f3ab80e0f4acbf4b2415ea1c2a6caf796`	Malicious classes.dex sample hash listed among affiliate-malware indicators.
SHA256	`9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8e`	Hash of libfleetshare.so, an ELF binary dropped by com.abc.nexus for the Fleet SDK.
SHA256	`a63757715b35ddd99916b63a1354de1ec05ac5855a480fe9a547b002e2091dcb`	Hash of Traffmonetizer key-storage material dropped by com.abc.nexus.
SHA256	`b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b`	Hash of libseccomp_guard.so, an anti-analysis component extracted by com.abc.nexus.
SHA256	`ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed`	Hash listed for the com.android.sso.auth.handler dropper package that installs AppSalt.
SHA256	`f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a`	Malicious module sample hash listed in the affiliate-malware indicators.
URL	`hxxp[:]//mcstb[.]anyevonline[.]com:8000`	XCPE HTTP bootstrap command-and-control URL used when the device property ro.mecool.device is true.
URL	`hxxp[:]//ott[.]szbboys[.]com:8000/cpe/file/upload`	XCPE endpoint for uploading device files, logs, or diagnostic dumps.
URL	`hxxps[:]//github[.]com/Aviciiii/ott/releases/download/cpe_ext_lib/lw_android_agent_special_ndk_64`	Specific operator-hosted GitHub release URL identified as a Linkfog payload download.