Ing. Calogero Bono
Google and several industry partners have dismantled XCPE, a backdoor that had enlisted more than 1.3 million set-top boxes into a botnet. According to Google's Threat Intelligence Group, the network was built and run for profit by Videostrong Technology Co., a maker of Android devices. The malware was inside the firmware, so customers bought it together with the box. The case matters because the compromise did not start with the user, and because removing it is not simple.
A few terms before we get into the facts. Backdoor is a hidden access point that lets someone control the device remotely. Botnet is a network of infected devices controlled by the same operator. C2 (command and control) refers to the servers that send orders to the devices. Residential proxy is a service that routes other people's traffic through a home internet connection. OEM/ODM refers to manufacturers that build devices for their own brand or for others.
What happened with the XCPE botnet?
According to Google, the XCPE backdoor was dismantled last week. Google used legal action to take down domains and servers with which Videostrong controlled the botnet and installed malicious modules. It also hit the C2 domains of more than a dozen malware families loaded through the backdoor.
The Japanese National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI collaborated. According to BleepingComputer, Google's report was published on Monday.
What did the backdoor do on TV boxes?
It runs as a system app in the firmware, with elevated privileges. To install software silently, reports The Hacker News, it first disables Google Play Protect checks. Operators could execute commands, capture the screen, send keystrokes, copy account data and logs, and open remote shells.
The command channel uses MQTT, a lightweight protocol. On the boxes, third-party modules turned them into residential proxies or tools for ad fraud. It is the same logic as other malware that selects the most profitable victims, but here the channel is the hardware itself.
Why does Google accuse Videostrong?
Google speaks of high confidence and says it does not believe a rogue employee or an oversight is to blame, because the code was present in many models and brands for years, with dedicated infrastructure. Synthient, according to BleepingComputer, found a public folder on a botnet server containing a document from Videostrong's R&D director. A company domain pointed to the same IP as the command server.
Google has cut ties with Videostrong and excludes it, along with future affiliates, from producing certified Android devices and supplying software to certified manufacturers.
Which devices are involved and can the malware be removed?
Most are Android TV boxes, but the code also appeared on telemedicine equipment, karaoke machines and digital signage. TrendAI counted 1,472,554 devices across 206 models between June 3 and October 1. Synthient publishes 182 model names, warning that the name alone does not prove infection, and focuses on MECOOL devices.
Removal is not reliable because XCPE reinstalls itself from the /oem/ partition on reboot. Plume recommends a factory reset, without saying whether it removes x.cpe. Synthient suggests throwing the boxes away.
Limits to know
Google does not say how many certified devices are involved, while Plume cites both certified boxes and AOSP versions. It is unclear whether a factory reset removes the backdoor. The figures diverge, 1.3 million for Google and 1.47 million for TrendAI over a different period. BleepingComputer has asked Google for further clarification and may update the story. We do not know whether Videostrong will respond to the accusations.
What changes for those working with digital tech
For a company, the risk lies in devices nobody manages. A TV box in a meeting room or a gadget at a collaborator's home can become an opening into the network. Take inventory of what is connected, separate smart devices from sensitive systems, and block the domains flagged by Synthient. If you manage servers and networks, managed hosting with security updates is not enough if the weak point is in the office. Anyone developing Android apps should remember that certification does not guarantee the firmware.
Our take
The most uncomfortable fact is the gap in Google's testing, which did not catch code loaded after the first boot. To its credit, the company acknowledged the problem and changed its review process. Still, the product on Videostrong's website was presented as Google certified. Consumers have no way to verify a firmware, and removing the manufacturer's advantage does not compensate them. What is needed is accountability across the supply chain, not just periodic takedowns.
Frequently asked questions
What is XCPE?
XCPE is a backdoor preinstalled in the firmware of Android TV boxes that linked them to a botnet. According to Google, it allowed access to be sold to criminals who used it for ad fraud and residential proxies.
Who is Videostrong?
It is a manufacturer based in Shenzhen that makes Android devices under its own brand and for others. Google holds it responsible and has revoked its ability to produce certified devices.
Can I remove XCPE from my box?
Not reliably. The malware reinstalls itself on reboot from the /oem/ partition. BleepingComputer suggests clean firmware or disconnecting from the internet, while Synthient recommends disposing of the box.
How do I know if my box is affected?
The model name alone is not enough. Synthient publishes a list of 182 models and indicators of compromise, but warns that the model alone does not confirm an infection.
Are the attacks over?
No. Google warns that criminals quickly move on to new tools. The takedown should cut access to at least 10 million other devices, but continuous action is needed.
What to watch after the XCPE takedown
The botnet has been hit, but infected devices are still out there. In the coming months, what matters is whether the operators regroup and how well Google's new controls hold up.
- Follow updates from BleepingComputer and the partners on the responses from Google and Videostrong.
- Check whether Google clarifies how many certified devices were affected and how firmware verification changes.
- Before buying TV boxes or smart devices for your company, ask the supplier who maintains the firmware and for how long.
