The TV box maker sold the backdoor itself

Google and industry partners have dismantled XCPE, a backdoor that enrolled more than 1.3 million Android set-top boxes into a botnet. The unusual part is who built it. Google's Threat Intelligence Group assesses with high confidence that the backdoor was intentionally developed, deployed and operated for profit by Videostrong Technology, an Android device manufacturer, which sold access to criminal affiliates and loaded their malware onto the boxes.

Those affiliate modules ran ad fraud, silently enrolled devices into residential proxy networks and installed further malware. Because the affiliates also distribute their modules through other channels, Google expects that taking down their command servers will cut off access to at least 10 million more compromised devices. The analysis also records Videostrong operators capturing live screenshots, injecting keystrokes, taking account and device data, and opening reverse shells on devices.

The backdoor was built to survive. A stub preloaded in the firmware runs with system privileges and, if a user uninstalls it, reinstalls itself from a protected partition on reboot. Since at least late 2024 it has used a three-stage design: the backdoor talks to the control server, a separate loader runs the modules, and the modules make the money. Commands arrive over MQTT and include silent app installs, disabling Google Play Protect, arbitrary shell commands and screen capture. Google says Videostrong used obfuscation to load the code after a device's first boot, exploiting a gap in Android's compatibility tests.

Google's response went beyond takedowns. It took legal action against the domains used to control the botnet and against the control domains of more than a dozen malware families loaded through it, banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and changed how it checks firmware integrity on certified Android TV devices. The work was done with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.