Google busts 1.3M-device Android TV botnet, bans maker Videostrong

Google and a crew of industry partners have dismantled XCPE, a botnet built from more than 1.3 million Android TV streaming boxes. Google says the devices were infected on purpose by the company that made them, and it's naming names: Chinese manufacturer Videostrong Technology Co. The company's reward was gone — Google revoked Videostrong's license to build Android TV devices with preloaded Google apps and services, banned it and its future affiliates from making certified Android gear, and ended the relationship entirely.

The takedown went well beyond those 1.3 million boxes. Google says it knocked out XCPE command-and-control servers used by more than a dozen related malware families, severing access to at least 10 million additional compromised devices. That wider pool includes retail set-top boxes, karaoke machines and telehealth hardware — and not all of them run Android. Japan's National Police Agency joined in, alongside security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.

This wasn't a break-in. The backdoor was baked straight into device firmware during manufacturing, a step up from the usual botnet playbook of exploiting bugs or duping users. The core components, tracked as x.cpe and com.oemservice, run with Android system-level privileges and phone home to a command-and-control server on the anyevonline domain to grab credentials for an MQTT message broker. From there, operators pushed out modules for ad fraud, residential proxying and fresh malware — including the backdoors Moyu, Spirit and Bird, plus proxy services like Linkfog, Honeygain, GaGaNode, NetNut and Traffmonetizer that quietly routed strangers' traffic through owners' devices.

Google's Threat Intelligence Group put it bluntly: "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co." In a separate report, Synthient said it traced the whole thing back to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max Android TV box bought in late 2025. An open directory on the malware's file server held a PDF by Owen Cao, Videostrong's R&D director, and the company's videostrong.cn domain resolved to the same IP as the C2 server. Synthient also found Videostrong company email addresses used to sign the backdoors — and Google said the evidence rules out a rogue insider or a development slip.

Good news for Google, bad news for anyone with an infected box. The malware lives in the /oem/ partition and reinstalls itself if deleted, so the takedown doesn't scrub it from devices already hit. Owners either flash clean firmware or unplug the thing from the internet. Google says it has also tightened its certification review process after learning Videostrong used obfuscation to slip past security testing and load malicious code only after a device's first boot.

Videostrong didn't sit still while all this was going on. Google says the manufacturer spent years spreading the malware across multiple brands and models, evolving its configuration to dodge detection and juggle criminal affiliates. A loader called com.abc.nexus took over module execution in late 2024, and operators later swapped it for smaller droppers disguised as Android system apps. BleepingComputer says it has asked Google for more details and will update if the company answers.