Google Dismantles XCPE Botnet That Infected 1.3 Million Android TV Devices With Preinstalled Malware

Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1.3 million Android set-top boxes.

Google Threat Intelligence Group (GTIG) assesses with high confidence that Android OEM and ODM Videostrong Technology Co. built and operated the backdoor for profit. The Google Threat Intelligence report calls it intentional, not a rogue insider or a development oversight.

Google Dismantles XCPE Botnet

Videostrong sold backdoor access to criminal affiliates and loaded their malware modules onto infected devices. The modules ran ad fraud, silently turned devices into residential proxy exit nodes, and installed further malware. Residential proxies route traffic through ordinary home IP addresses, which lets attackers evade detection.

Google also disrupted the command-and-control (C2) domains of more than a dozen affiliate malware families. Those affiliates also distribute modules through other channels, so Google expects the action to cut access to at least 10 million additional compromised devices.

Three-Stage Architecture

Since at least late 2024, the malware has used a modular design:

• Primary backdoor: x.cpe, sometimes named com.oemservice, is preloaded in firmware and runs as android.uid.system. If a user removes it, it reinstalls from the /oem/ partition at reboot.
• Loader: com.abc.nexus handles anti-analysis and module execution. It has recently been replaced by droppers that load a single module each.
• Monetization modules: These include proxy SDKs such as Linkfog, AppSalt, NetNut and GaGaNode, and ad-fraud tools such as CBOXTV and HiddenView.

The botnet uses a two-stage command-and-control (C2) process. Initially, devices send an HTTP POST request containing AES-encrypted hardware telemetry to retrieve their configuration.

Following this, they establish a persistent MQTT connection to the broker mqtt.szbboys[.]com. Through this MQTT connection, operators can discreetly install applications, execute shell commands, capture screens, inject keystrokes, and map victim networks. Google noted reverse shells and the exfiltration of account data, package inventories, and logs.

The backdoor disables Google Play Protect by setting the `package_verifier_user_consent` to -1. Additionally, the loader deploys `libseccomp_guard.so` to prevent sandboxing and instrumentation.

Since August 2026, operators have mass uninstalled `com.abc.nexus` and pushed droppers disguised as system applications, such as `com.android.system.ntp`. Some variants utilize `libexploit.so` to restart the Android Debug Bridge (adbd) with root access.

They then remount the system partition as read-write and copy themselves into `/system/priv-app/`. Properties like `persist.networkstack.uninstall` allow operators to manage cleanup processes.

Videostrong exploited a gap in Google’s compatibility testing by loading malicious code after the device’s initial boot. In response, Google has since revised its review process and firmware integrity checks for certified Android TV devices.

Google said Videostrong removed malicious modules from x.cpe in late 2024, possibly in response to its enforcement against BADBOX. That botnet family has a long history of preinstalled Android malware.

The Popanet component matches malware from Google’s NetNut disruption, and that earlier action already took down its C2 infrastructure. The same proxy economy was at work when Google disrupted the IPIDEA residential proxy network in January 2026.

Most victims are Android TV set-top boxes. Google also found the backdoor on telehealth devices, karaoke machines and digital signage, and some devices ran as many as three proxy SDKs at once. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, and it calls that figure a lower bound. Malaysia, Brazil, Iraq, Mexico and Taiwan had the highest counts.

Google pursued legal action against Videostrong’s domains and servers. It also banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. The investigation involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Owners cannot remove the implant themselves. TrendAI says cleanup requires vendor action, platform protection, or device replacement. Plume recommends a full factory reset because modules may have planted extra backdoors. However, it does not say a reset removes x.cpe.

Mitigations

Organizations should replace any affected set-top boxes, as user-level removal is often ineffective. They should also avoid uncertified or off-brand Android TV hardware. To minimize potential damage if a device is compromised, isolate smart devices on a guest network or separate network segment.

Defenders should block and monitor traffic to the domains szbboys[.]com and anyevonline[.]com. They should also be vigilant for unexpected MQTT or proxy traffic originating from streaming devices. Furthermore, partners recommend blocking the broker IP addresses 219.134.163[.]210 and 219.134.163[.]211.

Google warns that backdoor operators, ad-fraud rings, and residential proxy providers form an interconnected supply chain. To achieve lasting disruption, continued pressure on this infrastructure is necessary.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.