XCPE botnet takedown, Digi Mart USA News: Last week, Google and industry partners dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes into a botnet. Google assesses with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM).
Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. These secondary modules conducted ad fraud, silently enrolled infected devices into residential proxy networks, and loaded additional malware onto compromised devices.
Google also took action to disrupt the command and control (C2) domains that operate these affiliate modules.
Google said the affiliates each have diversified distribution channels beyond XCPE, so taking down their C2 domains is expected to sever access to at least 10 million additional compromised devices. The malicious software was built directly into many device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations designed to evade detection.
Google believes the campaign was not an isolated rogue insider or a development oversight.
As a result, Google has cut ties with Videostrong and banned the company from making devices with preloaded Google apps. Google requires OEMs to pass a comprehensive suite of compatibility and security tests, but Videostrong used obfuscation techniques to exploit a gap in those tests and loaded malicious code after the device’s first boot.
Google has since changed its review process to better guard against similar activity.
Google described the conduct as an unacceptable breach of trust. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide range of criminal actors, enabling ad fraud, data exfiltration, and the routing of malicious network traffic through the devices.
Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyze the malware ecosystem and disrupt its operations. Google said it expects the disruption to significantly affect these criminal operations but warned that the work is not finished.
Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain, and lasting disruption will require continued targeting of that infrastructure.
Google’s actions in support of the disruption included legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules, and legal action against C2 domains used by more than a dozen malware families loaded as modules through the backdoor. Google also banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices or supplying software to other certified vendors, and it is implementing improvements to how it verifies firmware integrity on certified Android TV devices.
According to Google’s analysis, the XCPE network was built for ongoing profit. By giving malware affiliates backdoor access, the operators monetized devices long after purchase.
Since at least late 2024, Videostrong has evolved its preinstalled malware from simple single-stage droppers into a modular, three-stage architecture designed for resilience and multi-tenant monetization.
The primary backdoor operates at the android.uid.system privilege level. The x.cpe package, which runs as com.oemservice in some builds, is preloaded in the firmware partition and reinstalls from the /oem/ partition after a user uninstalls it and the device reboots, maintaining persistent system-level access.
Its main function is to establish and facilitate communications between the C2 server and a loader and execution engine.
The loader, com.abc.nexus, handles module execution to evade security scans. It uses native anti-analysis utilities to thwart sandbox detection and configures and initializes the monetization modules.
Google said com.abc.nexus has recently been phased out in favor of more tailored dropper malware that loads and executes single modules.
Videostrong monetized its backdoored devices by loading modules developed by other entities acting as affiliates. These modules turned infected devices into residential proxy exit nodes, ad-fraud engines, or hosts for additional backdoors that load still more monetization modules.
Google said the botnet uses a two-stage C2 process, first fetching configuration settings over HTTP and then maintaining a persistent MQTT connection to receive instructions for silent app installations, arbitrary shell commands, screen captures, and network reconnaissance.
Google also observed Videostrong operators executing sensitive actions on infected devices, including capturing live screenshots, injecting keystrokes, exfiltrating account information, device information, package inventories and system logs, and running shell scripts and commands, including commands that established reverse shells. Google said the overwhelming majority of infected devices were Android TV set-top boxes, though it also observed infected telehealth devices, karaoke machines, and digital signage devices.
