DEV Community

Anoymask
Anoymask

Posted on

XCPE: Firmware-Embedded Backdoor Turns Over 1.3 Million Devices into Proxy and Ad Fraud Botnets

#security #threatintel

1. Basic Information

  • Title: Shutting the Door on the XCPE Botnet
  • Published by: Google Threat Intelligence Group
  • Published on: 2026-11-02
  • Original: Google Threat Intelligence Group
  • Associated Malware: x.cpe, com.oemservice, com.abc.nexus, CBOXTV, HiddenView, Moyu, Spirit
  • Associated Threat Actor: Videostrong Technology Co.
  • Associated CVE: None specified
  • Affected Products: Android set-top boxes, Android TV firmware
  • Severity: critical

2. Quick Summary

Google assesses with high confidence that system-level backdoors were intentionally embedded in the firmware of Videostrong set-top boxes, turning over 1.3 million devices into relays for proxy traffic, ad fraud, and the distribution of additional malware.

3. Attack Flow

From Firmware Pre-installation to Monetization Module Deployment

  1. Devices are shipped with x.cpe or com.oemservice pre-installed (preloaded) in the system partition.
  2. Upon boot, the package is installed from /oem/ to /data/app/ and runs with android.uid.system (system privileges).
  3. After retrieving initial configuration (bootstrap settings) via an HTTP POST request, it establishes a persistent connection to an MQTT broker.
  4. The C2 server delivers module configuration data and payloads to com.abc.nexus or individual droppers.
  5. Infected devices are repurposed into residential proxies, ad fraud operators, execution nodes for additional malware, remote shells, screen capture tools, and data exfiltration relays.

4. Attacker Position and Execution Location

  • Located within the device firmware supply chain, processes running with the system UID, MQTT-based C2 infrastructure, and module distribution infrastructure intended for affiliates.

5. Victim and Administrator Perspectives

Victims

  • Because devices function as normal set-top boxes from the time of purchase, users may only notice suspicious ad displays or sluggish performance.

Administrators

  • Observed as suspicious outbound MQTT traffic, downloads of unknown APK or ELF binaries, modification of Google Play Protect settings, internal network scans, proxy relay traffic, and the external transmission of screen captures or logs.

6. Success and Failure Conditions

Success Conditions

  • Devices running the affected firmware are connected to the network and can reach the initial setup server and MQTT C2.
  • Preloaded apps running with the system UID can deploy modules, execute shell commands, and modify device settings.

Failure Conditions and Mitigations

  • Disconnect and replace affected devices, isolate them into an IoT-dedicated VLAN, enforce outbound traffic allowlists, and block suspicious MQTT and proxy traffic.
  • Strengthen firmware integrity verification and OEM/ODM supply chain audits to inspect preloaded apps for system privileges and external communications.

7. What Happens Upon Success

  • Remote shell execution with system privileges, silent app deployment, and disabling of Google Play Protect.
  • Screen capture, keystroke injection, and exfiltration of account information, device details, and logs (note that keystroke injection is a feature where the attacker sends operation inputs, distinct from keylogging which records and steals user input).
  • Abuse as residential proxy exit nodes, relaying unauthorized third-party traffic through the victim's network connection.
  • Ad fraud, consumption of network bandwidth and computing resources, deployment of additional malware, and internal network reconnaissance.

8. Observable Logs

  • Email: No email-based initial vectors have been reported for this campaign.
  • Proxy / SWG / DNS: Device traffic to *.anyevonline.com, *.szbboys.com, mqtt.szbboys.com, GitHub Releases, and filemail.com.
  • Endpoint / EDR: x.cpe, com.oemservice, com.abc.nexus, native ELF binaries, reinstallation from /oem/ upon reboot, and modification of the package_verifier_user_consent setting.
  • Identity / IdP: Suspicious access or session anomalies involving Android account information linked to the device.
  • SaaS / Cloud: Asset inventories of affected models and firmware, connected devices outside of MDM management, and the enabled status of Google Play Protect.
  • Network: Connections to ports 3885 through 3887 on 219.134.163.210 / 219.134.163.211, MQTT traffic, reverse tunnels, TCP/UDP relaying, discovery traffic via traceroute or ping, and increased bandwidth consumption.

9. Attack Success Determination

Initial Execution Confirmed

  • Determination Stage: Initial Execution Confirmed (initial_execution) / Scope: XCPE-embedded devices
  • Basis: Public information: Google analyzed and confirmed pre-installation in firmware, automatic installation upon boot, and execution with the system UID.

Data or Session Compromise Confirmed

  • Determination Stage: Data or Session Compromise Confirmed (data_or_session_compromise) / Scope: XCPE C2 telemetry
  • Basis: Public information: In addition to real-time screen captures, C2 data confirms the exfiltration of account information, device details, package inventories, and system logs.

Follow-on Compromise Confirmed

  • Determination Stage: Follow-on Compromise Confirmed (follow_on_compromise) / Scope: Affiliate monetization modules
  • Basis: Public information: Activity was confirmed showing repurposing into residential proxies, ad fraud, additional malware delivery, and reverse shell execution.

10. Investigation Playbook

Trigger

  • Use the connection of affected set-top boxes, detection of packages such as x.cpe, traffic to known C2 domains, IPs, and ports, or unknown MQTT traffic as investigation triggers.

Initial Verification

  • Verify the device model name, firmware version, serial number, connected network segment, initial communication timestamp, DNS queries, destination IPs and ports, and traffic volume.

Endpoint

  • Preserve firmware images, installed package lists, /oem/, /data/app/, overall system settings, and native libraries when possible.

Identity / Cloud

  • Check account sessions and credentials tied to the device, and investigate suspicious logins originating from public IP addresses on the same network.

Follow-on Compromise

  • Track internal scanning, proxy abuse, reverse shell communications, deployment of additional APKs, pivot traffic to other devices, and degradation of public IP reputation.

Containment

  • Isolate and replace targeted devices, block C2, MQTT, and proxy traffic, rotate associated credentials, and review network segmentation.

Determination

  • Separately evaluate firmware pre-installation, C2 connection, command reception, data theft, proxy conversion, and propagation into the internal network.

11. Defense and Detection Ideas

Single Event Detection

  • Detect connections to mqtt.szbboys.com or ports 3885 through 3887 on 219.134.163.210 / 219.134.163.211.

Time-Series Correlation

  • Correlate device boot, initial HTTP POST configuration traffic, establishment of persistent MQTT connections, retrieval of APK/ELF binaries, and proxy relay or internal scan activity across a timeline.

Threat Hunting Perspectives

  • Search for x.cpe-related domains, non-standard port MQTT traffic, unknown proxy traffic, and payload retrieval from GitHub Releases in segments where Android devices and IoT equipment connect.

Logging Blind Spots

  • Because consumer IoT devices often lack detailed host-level logging or have limited visibility, supplement monitoring using DNS, NetFlow, DHCP, NAC, and switch port connection records.

Priority Mitigations

  • Prioritize replacing affected devices, isolating IoT networks, allowlisting outbound traffic, verifying firmware origins, and vetting OEM/ODM suppliers.

12. Facts, Inference, and Hypothesis

Facts

  • Google and industry partners neutralized the XCPE backdoor C2 infrastructure, and announced that set-top boxes registered to the botnet exceeded 1.3 million.
  • Google assesses with high confidence that Android OEM/ODM vendor Videostrong intentionally developed, deployed, and operated the backdoor and botnet for financial gain.
  • Google assesses that stopping the C2 for XCPE affiliate modules also cuts off access to at least 10 million additional devices compromised by affiliates through separate channels. This 10 million count is separate from the XCPE-infected device count (over 1.3 million).
  • x.cpe or com.oemservice is preloaded in the firmware partition and runs under android.uid.system. Even if deleted, it reinstalls from /oem/ upon reboot.
  • Initial HTTP POST traffic retrieves configuration, location, and STUN information, followed by a persistent MQTT connection to mqtt.szbboys.com to receive instructions for silent installation, arbitrary shell execution, screen capture, and network reconnaissance.
  • The backdoor can disable Google Play Protect app verification by changing package_verifier_user_consent to -1.
  • From C2 data analysis, Google confirmed real-time screen captures, keystroke injection, exfiltration of account information, device details, package inventories, and system logs, and the execution of shell scripts and reverse shells.
  • Monetization modules repurposed devices into residential proxy exit nodes such as Linkfog, AppSalt, and NetNut, ad fraud engines such as CBOXTV and HiddenView, and additional backdoors.
  • Google barred Videostrong from manufacturing or supplying certified Android devices with preloaded Google apps, took legal action against C2 and module domains, and strengthened firmware integrity reviews.
  • The Japan National Police Agency also participated in the investigation and neutralization efforts for this case.

Inference

  • Google's high-confidence assessment is based on public technical evidence and joint investigations, but does not exhaustively disclose all affected product brand names, geographic distribution counts, or specific victim impact ranges for individual device owners.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unresolved Points and Limitations".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1195.003 Compromise Hardware Supply Chain high Backdoor preloaded into system firmware prior to shipment.
T1059.004 Unix Shell high Shell scripts and reverse shells executed under system UID based on MQTT instructions.
T1105 Ingress Tool Transfer high Remote APKs, ELFs, and shell scripts retrieved from staging infrastructure.
T1113 Screen Capture high Screens continuously captured via non-public APIs and transmitted as JPEGs via MQTT.
T1090.002 External Proxy high Devices repurposed as residential proxy exit nodes across multiple modules.

14. Unresolved Points and Limitations

  • A complete list of affected models and brands, geographic distribution of all infected devices, legal entities behind each affiliate, breakdown of tasks actually executed on individual devices, and the full scope of fallback C2 infrastructure that may remain active after neutralization have not been publicly disclosed.

15. Impact on SOCs and Organizations

Japan's National Police Agency participated in the investigation and disruption. Organizations should include low-cost set-top boxes and Android-based video and display devices connected to home or corporate networks in asset management and monitoring. Do not trust firmware signatures or factory resets blindly; establish network-level detection for non-standard port MQTT traffic, known C2 domains, proxy relay behavior, and internal scans. If an affected device is identified, it should be replaced rather than simply reinitialized.

16. Summary by Role

  • SOC: Hunt for mqtt.szbboys.com, ports 3885 through 3887, anyevonline.com, non-standard MQTT traffic, internal scans, and suspicious proxy relay activity.
  • Administrators: Isolate and replace set-top boxes with opaque origins or OEM firmware, and block traffic from IoT VLANs into corporate networks.
  • Users: Because suspected devices will reinfect upon reboot even if reset, disconnect them from the network and replace them according to manufacturer or vendor guidance.

Top comments (0)