Threat watch / Campaign
XCPE: Google says a TV box maker built a backdoor into 1.3 million devices
Google's Threat Intelligence Group says it disrupted the XCPE botnet, made of more than 1.3 million Android TV set-top boxes with a backdoor preloaded in the firmware. Google assesses with high confidence that the maker, Videostrong, built and ran it on purpose to sell access to criminal affiliates. Cutting the affiliates' servers would sever access to at least 10 million more devices.
- Sector
- Consumer apps & devices
- Way in
- Supplier
- Product or vendor
- Videostrong
- How it happened
- Per Google, the backdoor (x.cpe, sometimes com.oemservice) is preloaded in the firmware and runs with system privileges. If it is uninstalled, it reinstalls itself from the /oem/ partition at reboot. Google says Videostrong passed its certification tests and used obfuscation to load malicious code after the first boot. Google assesses with high confidence that the manufacturer did this intentionally and for financial gain, and that it was not a rogue insider or an oversight.[1][2] Checked 8 Nov 2026
- What was stolen
- The aim was monetization more than theft. Google says infected devices were sold as access to criminal affiliates, who loaded residential proxy and ad-fraud modules and further backdoors. Operators could also install apps silently, disable Play Protect, run shell commands, capture the screen and map the local network, and exfiltrated "account information, device information, package inventories, and system logs".[1][2] Checked 8 Nov 2026
- Who was impacted
- More than 1.3 million set-top boxes, mostly Android TV. Google says disrupting the affiliates' servers will sever access to at least 10 million more devices, and that the backdoor was also seen on telehealth devices, karaoke machines and digital signage. Synthient says the real scale is likely higher and puts about 500,000 compromised devices online, mainly in Malaysia, Mexico and Brazil. Google banned Videostrong from building and selling certified Android devices. Whether owners will be notified is not stated in Google's post.[1][2][3] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Google publishes its report. It took legal action against the domains and servers used to control the botnet, cut ties with Videostrong and banned it from certified Android devices, with help from Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. [1][2]
- IT-Connect relays Synthient's advice: a factory reset does not remove the backdoor, stop using the affected hardware, watch DNS for szbboys[.]com and anyevonline[.]com and outbound traffic on ports 3885 to 3887. [3]
- Krebs on Security adds that Oxylabs, whose proxy software was among the modules, says it suspended the relationship with the supplier and sent a formal legal inquiry. No statement from Videostrong is reported. [2]