A manufacturer of Android TV set-top boxes deliberately shipped a backdoor inside its own firmware, then sold access to the infected devices to criminal affiliates, according to new research from Google Threat Intelligence Group. Google says that last week it and industry partners dismantled the resulting botnet, called XCPE, which had enrolled more than 1.3 million set-top boxes.
Google assesses with high confidence that the backdoor was developed, deployed and operated for financial gain by Videostrong Technology Co., an Android original equipment and device manufacturer. Google has cut ties with the company and banned it, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to other certified vendors.
A backdoor the owner could not remove
The core component, a package named x.cpe (running as com.oemservice in some builds), is preloaded in the firmware and runs with system-level privileges. If a user uninstalls it, it reinstalls itself from the device's /oem/ partition on the next reboot. Google says Videostrong used obfuscation to exploit a gap in its certification testing, loading the malicious code only after the device's first boot, and that it has since changed its review process.
Once running, the backdoor fetches configuration over HTTP and then holds a persistent MQTT connection (a lightweight publish and subscribe messaging protocol) to receive orders. Those orders include silently installing apps, running shell commands as the system user, capturing the screen and injecting keystrokes. The malware also switches off Google Play Protect's app verification so it can install payloads without asking. Google says it observed the operators capturing live screenshots, exfiltrating account and device information, and opening reverse shells on devices.
Why a TV box maker would rent out its customers
The money came from affiliates. Videostrong loaded other parties' modules onto the boxes, turning them into residential proxy exit nodes (Google names Linkfog, AppSalt and NetNut modules), ad-fraud engines (CBOXTV, HiddenView) or loaders for still more backdoors (Moyu, Spirit). Google found as many as three residential proxy SDKs running on a single device. Since late 2024 the design has evolved into a three-stage setup in which x.cpe handles command and control while a separate loader, com.abc.nexus, runs the monetization modules.
Most infected devices are Android TV set-top boxes, but Google also found telehealth devices, karaoke machines and digital signage running the backdoor. The pattern echoes earlier cases of streaming boxes quietly renting out home internet connections, and Google's own disruption of the NetNut proxy network earlier this year.
Still changing shape since August
Since August 2026, Google says new droppers disguised as system apps, with names such as com.android.system.ntp and com.android.sso.auth.handler, have been pushed over the MQTT channel in step with a mass removal of com.abc.nexus. Several variants carry a native library, libexploit.so, that restarts the device's ADB service as root and copies the app into the system partition with permission to install packages and reboot the device.
Takedown hits 10 million more devices
Google took legal action against the domains and servers Videostrong used to control the botnet, and against command and control domains for more than a dozen malware families delivered through it. Because those affiliates distribute their modules through other channels too, Google assesses the action will cut off access to at least 10 million additional compromised devices. It worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Block the C2 domains and hunt for the packages
Because x.cpe sits in firmware and reinstalls itself, owners cannot simply delete it. Network defenders can block and alert on the infrastructure Google describes and look for the package names above on Android devices in their environment. Selected indicators from the report:
- mcstb[.]anyevonline[.]com and stb*[.]anyevonline[.]com (HTTP bootstrap, port 8000)
- mqtt[.]szbboys[.]com (MQTT broker)
- hxxp://ott[.]szbboys[.]com:8000/cpe/file/upload (file upload)
- Packages: x.cpe, com.oemservice, com.abc.nexus, com.android.system.ntp, com.android.sso.auth.handler
The full report carries file hashes and further detail. Google is blunt that one takedown will not end this trade: backdoor operators, ad-fraud rings and proxy providers form a supply chain, and the cheapest box on the shelf may already be part of it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.