TV Box Botnet XCPE: 1.3 Million Devices Shipped With a Backdoor Built In

A TV box botnet that quietly enrolled more than 1.3 million devices has been knocked offline. Google, working with partners, says the malware did not sneak onto these boxes. It shipped inside them, put there by the manufacturer.

What Google and its partners took down

The botnet is called XCPE, after a component in the malware. Google’s Threat Intelligence Group says it was built into the firmware of Android TV set-top boxes made by Videostrong, a Shenzhen company that also builds boxes sold under other brands. Google expects the takedown to cut criminals off from at least 10 million more compromised devices.

The boxes were not the only victims. According to Google’s write-up, the same backdoor turned up in telehealth devices, karaoke machines and digital signage.

Google used legal action to seize Videostrong’s domains and servers, along with control domains for more than a dozen malware families. It also banned the company, and any future affiliates, from making certified Android devices. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI helped.

How the backdoor worked

A small package called x.cpe sat in the firmware and ran with system privileges. Remove it and it reinstalled itself on the next reboot. The device then phoned home over an MQTT connection, a lightweight messaging protocol, and waited for orders.

Those orders were mostly about money. A second component loaded modules that sold the owner’s internet connection as a residential proxy, or faked views for ad fraud. Google lists several proxy services among the payloads, including Honeygain-linked software, NetNut and Traffmonetizer. Other modules were backdoors that could pull in more code.

To install all this without a fuss, the malware switched off Google Play Protect, the Android app checker. TrendAI saw silent install commands reach more than 187,000 devices.

Videostrong reportedly sold access to criminal affiliates, who loaded their own modules. Google says Videostrong hid its code to slip past a gap in device testing and loaded the malicious parts after the first boot.

Why a TV box botnet is more than a nuisance

Shrugging is the natural reaction. The box still plays video, after all. But a residential proxy lets someone else browse the web from your address. Whatever they do, whether credential stuffing, scraping or fraud, appears to come from a home broadband line.

The operators could also take screenshots, send keystrokes and run shell commands on the box, according to TrendAI’s analysis. Some payloads mapped the local network. A device that can see the rest of your network is a foothold, and nobody chose to give it one.

For a business, the risk is not the box in the boardroom. It is the box in a director’s lounge or an employee’s spare room, on the same home network as a work laptop.

Who sold the boxes

Videostrong built boxes under its own name and for other brands. Synthient’s research found that MECOOL boxes, sold by Skyworth Technology, bundled Videostrong’s malware and proxy components. Synthient also published a list of 182 device model names seen in the campaign. It warns that a model name alone does not prove a box is infected.

This is the awkward part for buyers. Cheap, unbranded Android boxes are often white-label products, so the name on the carton may not match the firmware maker. Few retailers can say who wrote the software inside.

Google was blunt about intent. It says it does not believe a rogue insider or a mistake was to blame. In its words, a manufacturer deliberately infecting its own customers is “an unacceptable breach of trust”.

The UK exposure

TrendAI counted 1,472,554 infected devices across 206 models between 3 June and 1 October. It says the true figure is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan had the most. The UK was one of five countries, with the US, Germany, Australia and Canada, that each had roughly 26,000 to 42,000.

Takedown does not clean the boxes. The implant is signed with the maker’s key, so owners cannot remove it themselves. TrendAI says cleanup needs vendor action, platform protection or replacing the device. It also notes that operators like this have rebuilt on new servers before.

What UK organisations should do

• Ask staff who work from home not to put unbranded, uncertified Android boxes on the same network as work devices.
• Keep corporate access behind managed endpoints, and treat any unmanaged home device as untrusted. Our guide to zero trust security covers the thinking.
• If you buy connected hardware for offices, hotels or waiting rooms, buy from certified vendors and ask for evidence of firmware checks.
• Review the suppliers behind that hardware. A supplier security questionnaire is a start, though it cannot prove what is in a firmware image.

That last point is the lesson. Regulation such as PSTI sets a baseline, but as we argued in why IoT penetration testing still finds problems, a compliance label is not the same as inspecting the firmware.