XCPE is a botnet preinstalled in the firmware of multiple Android TV box models, rather than one that spreads by exploiting vulnerabilities or tricking users into installing malicious apps. Google Threat Intelligence Group (GTIG) said the network enrolled more than 1.3 million devices across over 200 countries into cybercriminal infrastructure before Google and its partners coordinated a disruption.
The case is a clear example of device supply-chain risk: a product may pass initial certification while still downloading malicious code after its first boot. For consumers and organizations, the key lesson is not only to choose reputable products, but also to control firmware, network traffic, and update lifecycles.
How is XCPE different from a conventional botnet?
Most botnets grow after attackers exploit weak passwords, unpatched vulnerabilities, or fake software. XCPE follows a more dangerous path: the x.cpe component, also seen as com.oemserviceis embedded in the firmware partition and runs with Android system privileges.
According to GTIG, if a user removes the component, it can reinstall itself from the /oem/ partition after a reboot. This firmware-level persistence means a factory reset or ordinary app removal is not enough to clean the device.
A three-layer architecture turns TV boxes into a crime platform
Since late 2024, XCPE evolved into a three-layer modular architecture. The first layer is a backdoor that communicates with command infrastructure; the second is a loader and execution engine; and the final layer consists of monetization modules supplied by multiple criminal affiliates.
This separation allows the core component to remain discreet while modules change according to criminal partners' needs. An infected device can become a residential proxy exit node, an ad-fraud engine, or a foothold for installing additional backdoors.
How do infected devices receive remote commands?
XCPE uses a two-stage control process. First, the device sends an HTTP request to retrieve configuration, location information, and connection parameters. It then maintains an MQTT connection to receive real-time commands, a model well suited to devices with low bandwidth or unreliable connectivity.
System privileges allow operators to silently install apps, execute shell commands, capture screenshots, collect account information, and survey the local network. When malicious traffic is relayed through residential IP addresses, criminal activity also becomes harder to distinguish from legitimate access.
Why did initial certification fail to detect it?
Google assesses with high confidence that the backdoor was intentionally developed and operated by Videostrong Technology for financial gain. The malware used obfuscation and loaded malicious components only after the first boot, exploiting a gap in pre-shipment compatibility and security tests.
This is a critical supply-chain governance lesson: certification at one point in time does not guarantee that firmware will remain safe throughout its lifecycle. Verification must continue after a device is activated and connected to a real network.
What did the disruption achieve?
Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyze and sever the infrastructure. Measures included legal action to disable command domains and servers, cut communications for more than a dozen related malware families, and block access to at least 10 million additional devices compromised through other channels.
Google also ended its relationship with Videostrong and banned the company and related entities from manufacturing certified Android devices or supplying software to certified vendors. Android TV firmware integrity checks were also revised.
What should Android TV box users check?
- Verify the exact manufacturer, device model, and firmware source instead of relying only on the brand printed on the box.
- Install clean firmware confirmed by a trusted supplier; if that cannot be verified, disconnect the device from the Internet and from networks containing important data.
- Place TV boxes and IoT devices on a separate guest network or VLAN, limiting access to computers, NAS systems, and management interfaces.
- Monitor unusual outbound connections, especially long-lived MQTT sessions, proxy traffic, and queries to domains unrelated to content streaming.
- Do not enter sensitive accounts or enable debugging privileges on devices with an unclear supply chain.
Lessons for organizations and security teams
Asset inventories should include inexpensive peripherals such as displays, media players, conferencing equipment, and connected medical hardware. These devices often sit outside endpoint management systems but can still observe internal networks or become proxies for attackers.
Effective controls should combine firmware provenance requirements, software bills of materials, network segmentation, DNS filtering, and post-deployment behavioral monitoring. When a firmware-level backdoor is found, replacing the device or flashing trusted clean firmware is generally safer than merely deleting an app.
Conclusion
XCPE shows that supply-chain risk can begin at the factory and persist inside a system partition. Disrupting command infrastructure reduces immediate abuse, but it does not mean malware has disappeared from every device. Long-term defense depends on firmware verification, device isolation, and continuous monitoring after deployment.
VNCyberS compiled from Google Threat Intelligence Group, BleepingComputer, and The Hacker News
Tiếng Việt
English