Google Dismantles 1.3 Million Device XCPE Botnet, Bans Android TV Maker Over Preinstalled Malware

Google and industry partners have dismantled the XCPE botnet, which enrolled more than 1.3 million set-top boxes through preinstalled malware. In a November 2 report, Google linked the operation with high confidence to Videostrong Technology, accusing the Android device maker of deliberately building and running the backdoor for profit.

According to Google’s technical investigation, Videostrong sold access to criminal affiliates that installed advertising fraud tools, proxy software, and further malware.

Google banned the company, including future subsidiaries and affiliates, from producing certified Android devices or supplying software to certified vendors.

1.3 Million Device XCPE Botnet Dismantled

The backdoor, named x.cpe or com.oemservice, was built into device firmware and ran with Android system privileges. Removing its installed package did not clear the infection because it could reinstall from the /oem/ partition after a reboot. Google said hidden code loaded after first boot helped bypass security checks.

Its three-stage design separated remote control from malware execution. The backdoor passed instructions to com.abc.nexus, a loader that configured affiliate modules.

Those modules turned devices into proxy exit points, generated fake advertising views, or installed more backdoors. This separation also helped keep malicious activity harder to detect.

Control traffic used MQTT, a lightweight messaging protocol. Google identified mqtt.szbboys[.]com on ports 3885–3887. Operators could silently install apps, execute shell commands, capture screens, and inspect networks.

Researchers also observed stolen account details and system logs, injected keystrokes, and commands that opened remote shell access. The malware could disable Google Play Protect verification.

Disruption Reaches Beyond XCPE

Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Legal action targeted XCPE servers and control domains serving more than a dozen affiliate malware families.

Google estimates these wider takedowns will sever access to at least 10 million additional compromised devices, separate from XCPE’s 1.3 million boxes.

The findings follow earlier Google legal action against BadBox 2.0, which affected over 10 million uncertified Android devices. Earlier BADBOX infections involving 190,000 Android devices also exposed the risks of compromised connected hardware. These earlier counts should not be combined with XCPE’s total.

Most XCPE infections involved Android TV boxes, but researchers also found affected telehealth equipment, karaoke machines, and digital signs. Google has changed its device review process and is improving firmware integrity checks following the discovery.

The takedown disrupts control infrastructure, rather than proving every device is clean. Google urges buyers to choose reputable manufacturers, consult its certified partner list, use trusted app stores, and keep Play Protect enabled. It also warns against apps offering payment for sharing unused bandwidth.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.