Google Cuts Ties With Videostrong After Backdoor Found in 1.3 Million Android Devices

Google says it dismantled the XCPE botnet of more than 1.3 million Android devices and cut ties with Shenzhen-based Videostrong Technology. Google says the company intentionally built a backdoor into device firmware and sold access to criminals. It has banned Videostrong from certified Android devices.

Google says one of its Android manufacturing partners secretly built a backdoor into 1.3 million devices and turned them into a botnet. Google said it severed ties with the partner, identified as Shenzhen-based Videostrong, after discovering the alleged backdoor. Google and industry partners dismantled the XCPE botnet, which consisted of more than 1.3 million Android TV streaming boxes.

Penalties for Videostrong

Google terminated its relationship with Videostrong and revoked its license to manufacture Android TV devices with preloaded Google apps and services. It also banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.

Google's Assessment

Google says it is highly confident that Videostrong intentionally put a backdoor in the boxes and sold access to criminals. The Google Threat Intelligence Group assesses with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology. Google said the malicious software was built into many device models and brands over multiple years, and that it believes the campaign was not an isolated rogue insider or development oversight. The XCPE botnet was embedded directly into device firmware during manufacturing.

How the Scheme Worked

Videostrong monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. Those modules conducted ad fraud, enrolled devices in residential proxy networks and loaded additional malware. Most criminal modules turned the boxes into residential proxies or sold their spare bandwidth, while other modules faked views of online ads. The infected devices were used without owners' knowledge for activity such as ad fraud, data exfiltration and routing unauthorized network traffic.

The backdoor, called x.cpe, runs as a system app inside the firmware with system-level access. To install software silently, it first turns off the app checks in Google Play Protect. Videostrong operators captured live screenshots, injected keystrokes, and exfiltrated account information, device information, package inventories and system logs. They also ran shell commands, including reverse shells.

After an infected device starts, XCPE contacts a C2 server on the anyevonline[.]com domain to obtain connection information and credentials for an MQTT message broker used to receive commands. The botnet's C2 uses an MQTT broker, mqtt.szbboys[.]com, resolved by hosts 219.134.163[.]210 and 219.134.163[.]211, listening on ports 3885-3887. The report named residential proxy providers whose SDKs were downloaded by XCPE-infected devices, including AppSalt (Honeygain, owned by Oxylabs), NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.

Affected Devices

Most affected products were Android TV set-top boxes. The botnet also infected other Android-based IoT devices, including telehealth devices, karaoke machines and digital signage. Synthient traced the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.

Takedown and Remaining Risk

Google used legal action to take down the domains and servers that controlled the botnet. It also took down the control domains of more than a dozen malware families loaded through the backdoor. Google assesses that taking down the affiliates' C2 domains will sever access to at least 10 million additional compromised devices, because the affiliates have distribution channels beyond XCPE. Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to analyze and disrupt the malware ecosystem.

The malware has not been removed from infected devices, and it reinstalls itself from the /oem/ partition if removed. Users would need to install clean firmware or disconnect the device from the internet.

Testing Gap and Review Changes

Google says Videostrong used obfuscation to exploit a gap in its compatibility and security tests and loaded malicious code after a device's first boot. Google says it has since addressed that weakness and changed its review process for device manufacturers. In late 2024, possibly in response to earlier Google enforcement related to BadBox, Videostrong removed malicious modules from x.cpe and introduced a separate package, com.abc.nexus, as loader and execution engine.