Do Son 
XCPE malware overview
At a Glance
| Malware Family | XCPE botnet (x.cpe / com.oemservice firmware backdoor and com.abc.nexus loader) |
| Threat Actor | Confirmed attribution to hardware manufacturer Videostrong Technology Co. |
| Target / Victims | Over 1.3 million Android TV set-top boxes, telehealth devices, karaoke machines, and digital signs; severed access to over 10 million affiliate bots |
| Delivery Vector | Pre-installed factory firmware within the /oem/ system partition |
| Key Capabilities | Persistent MQTT remote control, silent APK installation, Google Play Protect tampering, residential proxy monetization, and ad fraud |
TL;DR
Google and international law enforcement dismantled an operation that enrolled over 1.3 million streaming boxes into the XCPE botnet. Manufacturer Videostrong Technology built the backdoor directly into factory firmware to generate illicit post-sale revenue. Furthermore, this Videostrong XCPE botnet deployment leased infected hardware to criminal affiliates for ad fraud and residential proxy routing.
Delivery and Attribution
Google and its industry coalition took coordinated legal and technical action against the malicious operation last week. Investigators confirmed that Chinese electronics vendor Videostrong Technology developed and managed the backdoor across several brands. The vendor manufactured popular hardware lines such as Mecool alongside white-label devices for international distributors. Rather than experiencing an accidental supply chain flaw, Videostrong deliberately pre-installed the backdoor inside the system partition during manufacturing.
Confirmed attribution links the entire operation to Videostrong rather than a rogue developer or contractor. As Google researchers stated, “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users.” Consequently, Google cut all business ties with Videostrong and revoked its Android TV certification rights.
The scale of the operation reached far beyond standard set-top boxes. Investigators identified the backdoor on telehealth monitors, commercial karaoke consoles, and smart digital advertising boards. Furthermore, taking down affiliate command servers severed access to over 10 million additional compromised devices.
Infection Chain
The infection begins with a factory-installed software package named x.cpe or com.oemservice. Because the vendor placed the file inside the /oem/ firmware partition, the code executes with system privileges. Even if a user attempts manual uninstallation, the operating system reinstalls the package from firmware upon reboot. In addition, x.cpe exports internal configuration tables to share command parameters with local multimedia applications.
Loader Execution and Process Hardening
In earlier versions, the main backdoor executed fraud components directly. However, the operators later separated operations by routing commands to a secondary loader package named com.abc.nexus. The loader uses an anti-analysis utility called libseccomp_guard.so to block security instrumentation. Specifically, this utility filters system calls to stop automated sandboxes from pausing threads or tracking processes.
To ensure unrestricted payload execution, the malware alters operating system verification flags. The application modifies system database settings to disable Google Play Protect package scanning. Next, the loader fetches monetization packages from operator-controlled repositories on GitHub and remote staging servers. In recent campaigns, Videostrong deployed stealthy dropper packages named com.android.system.ntp. These packages run local debug bridges as root to copy payloads directly into the private system folder.
Command-and-Control and Data-Exfiltration Behaviour
The XCPE botnet uses a two-stage communication model to direct compromised hardware. First, infected devices send encrypted HTTP requests to staging servers on anyevonline.com to fetch network configurations. Next, the software establishes a real-time connection to a central message broker over the lightweight MQTT protocol. According to the Google Threat Intelligence report, “The x.cpe network was built for ongoing profit.”
Remote Device Control
Through the active MQTT channel, operators push arbitrary shell commands and silent application download tasks. The backdoor can also inject synthetic keystrokes and capture device screens via internal graphics interfaces. In addition, built-in network utilities perform traceroute scans and internet routing queries to map local subnets. Operators extract device identifiers, software inventories, and network logs back to remote staging servers.
Monetization Modules and Proxy Routing
Videostrong monetized infected boxes by leasing device bandwidth to residential proxy services. Loaded modules include Linkfog, AppSalt, BWM, GaGaNode, Traffmonetizer, and EarnFM. These tools convert consumer television boxes into proxy exit nodes for remote traffic. Furthermore, the loader drops ad-fraud engines like HiddenView and Fission. These applications run hidden browser windows to generate fake advertising impressions without displaying creative content to viewers.
Defense and Detection Guidance
Defenders and consumers face unique challenges when hardware arrives compromised from the factory. Because the malware resides in firmware, standard factory resets cannot purge the infection. Therefore, users must disconnect uncertified Android TV boxes from home networks immediately. Consumers should replace questionable hardware with streaming devices from certified manufacturers listed on the official Android TV partner portal.
Network administrators should monitor local traffic for unauthorized MQTT communication on non-standard ports 3885 through 3887. Security teams can also inspect domain logs for lookups pointing to szbboys.com and anyevonline.com. Furthermore, enterprise administrators should isolate Internet of Things appliances on dedicated virtual local area networks. Finally, distributors and retailers must mandate independent firmware verification before selling white-label consumer electronics.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
