“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the Google Threat Intelligence Group wrote, laying out an unusually explicit charge against an Android device maker.
GTIG says Videostrong built XCPE and Google cut ties
In a November 2 blog post, the Google Threat Intelligence Group (GTIG) said it assessed “with high confidence” that Android ODM/OEM Videostrong Technology was responsible for the XCPE botnet and its built-in backdoor. GTIG said it found the backdoor “built directly into many different device models and brands over multiple years,” and that the campaign showed signs of dedicated infrastructure and evolving configurations to evade detection. As a consequence, Google said it has “cut ties with Videostrong and banned them from making devices with preloaded Google apps.”
The XCPE backdoor: persistence, control, and capabilities
GTIG described the backdoor — named x.cpe — as operating at android.uid.system privilege level and persisting in the device firmware. The backdoor reinstalls itself from the /oem/ partition on reboot if a user attempts removal. On startup, x.cpe contacts a command-and-control (C2) server and uses an MQTT message broker to receive commands. According to GTIG, affiliates could use that channel to remotely execute shell scripts, disable Google Play Protect, and silently install additional apps.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMonetization: affiliates, malware modules, and residential-proxy providers
Google said Videostrong “monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices.” Those secondary modules performed ad-fraud, enrolled infected devices into residential proxy networks without users’ knowledge, and loaded additional malware. GTIG named several residential proxy or monetization providers implicated in the chain, including Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer. The post noted that “residential proxy providers” enable downstream abuses such as account takeover, payment fraud, ad/click fraud, web scraping and DDoS.
Scale: millions of devices and a wide range of hardware
GTIG reported that Videostrong’s XCPE backdoor was embedded in devices sold for several years and affected a range of hardware beyond set-top boxes. The botnet “contained more than 1.3 million set-top boxes,” and GTIG said the XCPE network also included compromised telehealth devices, karaoke machines, and digital signage. Industry action, GTIG wrote, disrupted XCPE C2 servers being used by criminal affiliates to install “over a dozen malware families” onto victims’ devices and helped to sever control of “over 10 million of these compromised devices” from the bot-herders.
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: The GTIG description highlights firmware persistence in the /oem/ partition and the use of MQTT as a command channel; teams will need to consider firmware-level integrity checks and monitoring for unauthorized MQTT connections and behavior such as disabling Google Play Protect or silent app installs.
- Policymakers and regulators: Google’s closing argument—“Creating lasting change requires accountability across the hardware supply chain, the residential proxy industry and the broader technology ecosystem.”—frames this as a governance problem as well as a technical one. The company also described the campaign as more than “an isolated rogue insider or a development oversight,” implying regulatory attention to supply-chain practices may follow.
- Procurement and device buyers: Google’s move to ban Videostrong from shipping devices with preloaded Google apps underscores a leverage point for platform providers and a risk vector for purchasers: preinstalled firmware components can contain high-capability backdoors that survive standard removal attempts.
GTIG warned that the illicit market underpinning this activity is resilient: “Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain, and when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs.” The combination of deep firmware persistence, service-level monetization, and wide hardware reach makes XCPE an instructive case: disruption can sever control over many millions of devices, but lasting change, GTIG argued, will require accountability across the hardware supply chain and the proxy and monetization services that turn device access into profit.
https://www.infosecurity-magazine.com/news/police-tech-firms-team-up-to/
