Google Disrupts XCPE Botnet on 1.3 Million Android TV Boxes, Bans Maker
Summary
Google and partners disrupted the XCPE botnet, which Google says was built into over 1.3 million Android TV boxes by Videostrong. Google revoked the maker’s certification, but infected devices still need clean firmware or internet disconnection.
Key points
- Google attributes the botnet with high confidence to Videostrong Technology Co., alleging the manufacturer deliberately embedded a persistent backdoor in devices.
- Google says the disruption took down XCPE command servers and cut off access to at least 10 million additional compromised devices across other types of hardware.
- The x.cpe and com.oemservice backdoor components ran with Android system-level privileges and used an MQTT broker for commands and malware delivery.
- Google says operators used infected devices for ad fraud, residential proxy services, remote commands, and installation of additional malware.
- Synthient cited a publicly accessible malware directory, links between Videostrong and command infrastructure, and company email addresses used to sign backdoors as evidence in its attribution.
- Google terminated its relationship with Videostrong and revoked its license to manufacture certified Android TV devices.
- The takedown did not remove malware from infected devices; Google says users need clean firmware or should disconnect affected devices from the internet.
Article Details
- Event Type
- Disruption of the XCPE Android malware botnet and termination of Videostrong Technology Co's Android TV certification
- Impact
- Google and partners took down XCPE command-and-control infrastructure used by more than 1.3 million infected Android TV boxes and cut off access to at least 10 million additional compromised devices. The malware enabled ad fraud, residential proxy traffic, remote command execution, and installation of additional malware. Google says infections remain on affected devices and require clean firmware or internet disconnection to prevent further activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | anyevonline[.]com | Domain used by XCPE-infected devices to obtain command-and-control connection information. |
| DOMAIN | file[.]anyevonline[.]com | Server hosting backdoors used by the XCPE operators. |
| DOMAIN | mqtt[.]anyevonline[.]com | Command-and-control server used to list compromised devices, send commands, and manage application installations. |
| DOMAIN | mqtt[.]szbboys[.]com | MQTT broker used by XCPE operators to send commands and deploy malware to infected devices. |
People
Threat Actors
Malware
BirdSome modules installed other backdoors, including Moyu, Spirit, and Bird, to download and execute other malware.com.abc.nexusIn late 2024, Videostrong began using a separate loader called com.abc.nexus, which ran the malicious modules while XCPE focused on communications with the C2 infrastructure.MoyuSome modules installed other backdoors, including Moyu, Spirit, and Bird, to download and execute other malware.SpiritSome modules installed other backdoors, including Moyu, Spirit, and Bird, to download and execute other malware.x.cpeThe main backdoor component, tracked as x.cpe and com.oemservice, run with Android system-level privileges.XCPEGoogle disrupts million-device XCPE Android malware botnet, bans TV box maker
Vendors
GoogleGoogle disrupts million-device XCPE Android malware botnet, bans TV box makerVideostrong Technology Co.The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately installing a persistent backdoor into devices it manufactured and
Products
Android TVGoogle and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generateMECOOL KM9PRO Maxthe XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.