More than 1.3 million Android TV Boxes were incorporated into XCPE, a botnet that resold home internet connections and loaded malicious activity modules. Google and industry partners dismantled its control infrastructure and severed its ties with Videostrong Technology Co., the manufacturer they say deliberately installed the backdoor.
The devices arrived in homes with the malware embedded in the firmware before they were sold. Their owners received no warnings and did not have to install an app or open a file to be exposed: the infection activated after the first boot, using techniques that bypassed pre-deployment security checks.
A backdoor for reselling connections
According to Google's Threat Intelligence Group (GTIG), Videostrong used XCPE to give criminal affiliates access and let them install modules on infected devices. These components turned users' internet connections into residential proxy nodes, through which third parties could route traffic using home IP addresses. They were also used for ad fraud and to install more malware.
The operation mainly affected TV Boxes, but XCPE also appeared in other Android products, including telemedicine devices, karaoke machines, and digital signage systems. Google said the software had been integrated into various models and brands over several years.
GTIG also reported activity beyond bandwidth resale: extracting information from devices, networks, and accounts; taking screenshots; and remotely executing commands. In the set analyzed by Google, the backdoor could receive instructions to install apps without notifying the user and perform actions on the device.
The campaign did not rely on a single proxy service. Google's analysis identified components associated with providers such as AppSalt, also known as Honeygain, and NetNut, as well as EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. KrebsOnSecurity also reported that the malware distributed Grass software, according to Ben Brundage, founder of Synthient.
Google blocks Videostrong and its servers
Google took legal action to take down the domains and servers Videostrong used to control XCPE and install modules. It also acted against command-and-control domains used by more than a dozen malware families distributed through the backdoor. The company barred Videostrong and its future subsidiaries or affiliates from manufacturing and selling certified Android devices, and prohibited them from supplying software to other certified manufacturers.
According to Google, the problem was that Videostrong managed to load malicious code after the device's first startup, thereby bypassing a gap in compatibility and security testing. The company has changed its review process and introduced improvements to verify the firmware integrity of certified Android TV devices.
Google coordinated the disruption with Plume, TrendAI, Lumen, HUMAN Security, Synthient, and Japan's National Police Agency. Each organization contributed malware analysis, threat intelligence, or network visibility to identify and dismantle the infrastructure.
“Operations like this raise the cost for criminals and show that the infrastructure they depend on is not beyond our reach.”
— Charley Snyder, Head of Disruption Operations, Google Threat Intelligence Group
The operation's scope could still grow
In addition to devices directly linked to XCPE, Google estimates that taking down the control domains could cut off access to at least 10 million more compromised devices. This estimate reflects the fact that affiliates also distributed their modules through other channels, not just through Videostrong's botnet.
Synthient considers the figure of 1.3 million conservative. Its founder, Ben Brundage, told KrebsOnSecurity that the actual number of affected devices could be much higher. The company also examined MECOOL TV Boxes and concluded that some contained Videostrong malware and proxy components. That assessment applies to the devices examined, not every model from the brand.
Google expects the intervention to significantly disrupt criminal operations, but warned that the takedown does not end the work: backdoor operators, ad fraud networks, and proxy services form a connected chain. For now, legal action has been taken against the identified control domains, and Videostrong can no longer manufacture certified Android devices.
Sources: krebsonsecurity.com, The Verge, 9to5Google, Google Cloud Blog, Cision PR Newswire
