XCPE's firmware-first infection model
Google says the XCPE botnet differed from many device-borne campaigns because the malicious code was embedded directly into device firmware at the point of manufacture. The primary backdoor components—tracked as x.cpe and com.oemservice—ran with Android system‑level privileges and survived removal by reinstating themselves from the device /oem/ partition. Because the malware is persistent in firmware, Google warns that cleaning an infected device requires installing clean firmware or disconnecting the device from the internet to stop further malicious activity.
How the botnet operated: C2, MQTT and modular plug‑ins
After boot, XCPE contacted a command‑and‑control (C2) server on the anyevonline[.]com domain to retrieve connection information and credentials for an MQTT message broker. Google identified the MQTT broker as hosted at mqtt.szbboys[.]com and described a modular architecture that separated the persistent backdoor from revenue modules used by criminal affiliates.
Through that connection, operators could silently download and install Android applications, disable Google Play Protect, execute shell commands and scripts with system privileges, capture screenshots, inject keystrokes, collect account and device information, and perform network reconnaissance and reverse shells. The operators used the backdoor as a platform, installing third‑party modules that performed residential proxying and ad fraud or installed additional backdoors.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRevenue modules, secondary backdoors and affected device types
Google says the botnet hosted modules tied to residential proxy services identified as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer—software that routes third‑party internet traffic through infected devices without owners' knowledge. Other modules generated ad fraud by loading hidden pages, producing impressions, and clicking advertisements. Some modules delivered other backdoors, including Moyu, Spirit, and Bird.
While Google focused on more than 1.3 million Android TV streaming boxes infected with XCPE, the disruption also cut access to at least 10 million additional compromised devices that had been managed via C2 servers used by more than a dozen related malware families. Those additional affected devices included retail set‑top boxes, karaoke machines, and telehealth hardware; Google notes that not all of the affected devices were Android‑based.
Tracing the malware to Videostrong and the infrastructure evidence
Google attributes the campaign with high confidence to Chinese device manufacturer Videostrong Technology Co., saying the company intentionally installed a persistent backdoor and sold access to criminal affiliates. Cybersecurity firm Synthient traced XCPE to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.
Synthient reported finding a publicly accessible directory on file.anyevonline[.]com that hosted backdoors and included a PDF authored by Owen Cao, the R&D director of Videostrong Technology Co. Researchers also found Videostrong's videostrong[.]cn domain pointing to the same IP address as mqtt.anyevonline[.]com, the C2 server that allowed listing compromised devices and managing installations. Multiple Videostrong company email addresses were used to sign backdoors, and Google says the evidence points to deliberate manufacturer installation rather than a rogue insider or accidental oversight.
Google's disruption, partner coordination, and vendor sanctions
Google says it worked with Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyze the malicious infrastructure and disrupt operations. As part of the disruption, Google took down XCPE C2 servers used by more than a dozen related malware families, cutting off access to the 10 million additional compromised devices.
Google has also terminated its relationship with Videostrong: it revoked Videostrong's license to manufacture Android TV devices with preloaded Google apps and services and banned the company and any future affiliates from producing certified Android devices or supplying software to certified vendors. Google said it modified its certification review process after finding Videostrong used obfuscation techniques to evade security testing and load malicious code after first boot.
What this means for technologists, procurement leaders, and device owners
- Technologists and security teams: Expect a persistent‑firmware threat model; removing XCPE requires firmware replacement or network isolation. Teams should assume some C2 servers remain offline but infections persist on device partitions.
- Procurement leaders and certified device vendors: Google’s revocation of Videostrong’s certification and the company ban illustrates that supply‑chain trust for preinstalled device software can be rescinded; procurement processes and certification reviews were already changed by Google to detect post‑boot malicious loading and obfuscation.
- Device owners and consumers: Owners of implicated set‑top boxes should disconnect devices from networks until clean firmware can be installed, because the backdoor automatically reinstalls from the /oem/ partition if removed.
The disruption removed the operators' remote control and split the botnet's ecosystem, but the persistent nature of XCPE—embedded at manufacture and able to reinstall itself—means the underlying infections remain in situ. Google and its partners have cut channels and revoked certification, yet the simplest fact is unambiguous: infected devices still contain the backdoor and will continue to be a risk until firmware is replaced or devices are isolated. Read the original report.
