Skip to content
Threat Feed
Subscribe
high threat

Videostrong Technology x.cpe Botnet

The x.cpe botnet, operated by Videostrong Technology, utilized a pre-installed backdoor on over 1.3 million Android TV devices to deploy modular malware, disable security protections, and conduct unauthorized proxying, ad fraud, and network reconnaissance.

Triage facts

Revision 2
Applicability
Android TV boxes (including MECOOL brand), Android TV set-top boxes +3
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 2Nov 3, 20:43 UTC
Source quality
A1Almost certain
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for Android TV set-top boxes +3 products

    Changed: action_plan, affected_products, lastmod, references, tags, ttps, updates

    Sources: 1

Google’s Threat Intelligence Group identified and disrupted a large-scale botnet known as x.cpe, affecting more than 1.3 million Google-certified Android TV devices. The operation was attributed to Shenzhen-based manufacturer Videostrong Technology, which leveraged a pre-installed backdoor to remotely push malicious modules after device deployment. The malware transformed infected hardware into nodes for residential proxy networks, ad fraud schemes, and local network reconnaissance tools.

Attack Chain

  1. Supply Chain Compromise: Videostrong Technology pre-installs a stub application (com.oemservice) on Android TV hardware during manufacturing.
  2. Initial Provisioning: The device is sold and set up by the end-user, connecting to the internet.
  3. C2 Beaconing: The stub application initiates contact with attacker-controlled command-and-control servers.
  4. Defense Evasion: The stub application disables Google Play Protect to prevent the detection of subsequent malicious payload installation.
  5. Payload Deployment: The operator remotely installs modular malware payloads via system-level permissions granted to the stub application.
  6. Malicious Execution: Modules execute unauthorized tasks including residential proxy traffic routing, ad fraud, and lateral network probing.

Impact

Over 1.4 million devices were confirmed to be infected, with significant concentrations in Brazil, Malaysia, Iraq, Mexico, and Taiwan, and thousands of affected devices across the US, UK, Germany, Australia, and Canada. The botnet allowed operators to capture device screens, execute terminal commands, and probe local network infrastructure.

Recommendation

  • Inventory all Android TV devices within the corporate network, specifically identifying MECOOL-branded and white-label hardware manufactured by Videostrong Technology.
  • Monitor network traffic for anomalies originating from Android TV devices, particularly high volumes of outbound traffic characteristic of residential proxy activity.
  • Restrict internal network access for IoT and media streaming devices by isolating them in a dedicated VLAN with strictly enforced egress filtering.
  • Implement device management policies that prohibit the use of unmanaged, consumer-grade Android TV hardware for accessing sensitive corporate resources.

Immediate actions

Audit network logs for Android TV hardware communicating with unknown or suspicious domains, following identification of MECOOL devices.

SOC 24h

Isolate or replace devices known to be manufactured by Videostrong Technology from enterprise and sensitive internal networks.

IT Operations 48h

Threat Hunt

Identify Android TV devices in the environment and baseline their network traffic for large volume proxy activity or unexpected connections to unknown C2 infrastructure.

T1071.001 high high confidence hunt now

Data: Firewall or proxy logs capturing traffic from Android TV IP addresses

Identify and investigate IoT devices in the environment exhibiting persistent outbound traffic to unknown or non-standard external domains, especially those acting as residential proxies.

T1090.002 high high confidence hunt now

Data: Firewall or Proxy logs showing high-volume connections from IoT device IP addresses

Mitigations

Isolate MECOOL-branded and known Videostrong-manufactured Android TV boxes from the internal corporate network.

immediate IT Operations

Supply chain compromise via Videostrong hardware