**Google** and a coalition of industry partners have announced the successful dismantling of the **XCPE** malware botnet. This massive network exploited over 1.3 million Android TV streaming boxes, which **Google** asserts were intentionally compromised by their manufacturer, **Videostrong Technology Co.**, to generate illicit revenue through cybercrime. ### Manufacturer Accused of Intentional Infection **Google**'s Threat Intelligence Group (**GTIG**) has publicly accused **Videostrong Technology Co.** of deliberately embedding a persistent backdoor into its manufactured devices. Access to these backdoored devices was then allegedly sold to criminal affiliates. These affiliates leveraged the compromised hardware to deploy malicious modules, engaging in activities such as ad fraud, turning devices into residential proxies, and installing further malware. Beyond the **XCPE** botnet, **Google**'s disruption efforts extended to taking down command-and-control (C2) servers linked to more than a dozen related malware families. This action cut off access to an estimated 10 million additional compromised devices. These devices, not all of which were Android-based, included retail set-top boxes, karaoke machines, and telehealth hardware, compromised through various malware distribution methods. ### Severe Repercussions for Videostrong In response to these findings, **Google** has severed its ties with **Videostrong**. The manufacturer's license to produce Android TV devices with preloaded **Google** apps and services has been revoked, and the company—along with any future affiliates—is now banned from manufacturing certified Android devices or supplying software to certified vendors. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by **Videostrong Technology Co.**," **GTIG** stated in a report. ### A Collaborative Takedown The operation was a collaborative effort, involving the Japan's National Police Agency and security firms such as **Lumen**, **HUMAN Security**, **Plume**, **Synthient**, and **TrendAI**. These partners coordinated to analyze the malicious infrastructure and execute the disruption. ### The Anatomy of the XCPE Botnet Unlike many botnets that exploit vulnerabilities or trick users, the **XCPE** botnet was distinct in its method of infection: it was embedded directly into the device firmware during manufacturing. **Google** revealed that **Videostrong** had been developing and distributing this malware across numerous device brands and models for years, continuously evolving its capabilities to evade detection and support various criminal affiliates. "We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," **Google** noted. The primary backdoor component, identified as `x.cpe` and `com.oemservice`, operated with Android system-level privileges. Its modular architecture separated core backdoor functions from revenue-generating modules for affiliates. Upon device startup, **XCPE** would contact a C2 server on the `anyevonline[.]com` domain to acquire **MQTT** message broker credentials, subsequently used for receiving commands. This C2 connection enabled operators to remotely control compromised devices and execute malicious actions, including: * Silently downloading and installing additional Android applications. * Disabling **Google Play Protect**. * Executing shell commands and scripts with system privileges. * Capturing screenshots and injecting keystrokes. * Collecting account information, device details, installed application lists, and system logs. * Conducting network reconnaissance and establishing reverse shells. The devices also served as a platform for other cybercriminals, installing modules associated with residential proxy services like **Linkfog**, **AppSalt/Honeygain**, **GaGaNode**, **NetNut**, and **Traffmonetizer**. These services covertly routed third-party internet traffic through infected devices. Other modules engaged in ad fraud by generating ad impressions, loading hidden webpages, and clicking advertisements. Some even installed additional backdoors, including **Moyu**, **Spirit**, and **Bird**, to facilitate further malware deployment. To elude detection, the botnet operators consistently altered the malware's architecture. In late 2024, **Videostrong** introduced a separate loader, `com.abc.nexus`, to run malicious modules while **XCPE** focused on C2 communications. By August 2026, this loader was replaced with smaller, specialized droppers disguised as Android system applications. ### Attribution to Videostrong Independent cybersecurity firm **Synthient** published a coordinated report detailing how it traced the **XCPE** backdoor and infrastructure back to **Videostrong**. This attribution followed the discovery of the preinstalled malware on a **MECOOL KM9PRO Max** Android TV box. **Synthient**'s investigation uncovered a publicly accessible directory on the malware's `file.anyevonline[.]com` server, which contained backdoors and a PDF folder with a document by Owen Cao, the R&D director of **Videostrong Technology Co.** Further evidence included **Videostrong**'s `videostrong[.]cn` domain resolving to the same IP address as `mqtt.anyevonline[.]com`, the C2 server. Additionally, numerous **Videostrong** company email addresses were found to have signed the backdoors. **Google**'s assessment confirms that the campaign was not an isolated incident involving a rogue employee or a development oversight, but rather a deliberate action by the manufacturer. ### Post-Takedown Mitigation In light of these findings, **Google** has revised its certification review process, acknowledging **Videostrong**'s use of obfuscation techniques to bypass security testing and load malicious code post-boot. While the takedown has disrupted **XCPE**'s operations, the malware remains on infected devices. It will automatically reinstall itself from the `/oem/` partition if removed. Users are therefore advised to install clean firmware or disconnect affected devices from the internet to prevent ongoing malicious activity.