{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/android-tv-boxes-including-mecool-brand/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Videostrong Technology"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Android TV boxes (including MECOOL brand)","Android TV set-top boxes","Telehealth devices","Karaoke machines","Digital signage devices"],"_cs_severities":["high"],"_cs_tags":["botnet","android","supply-chain","supply-chain-attack","iot"],"_cs_type":"threat","_cs_vendors":["Videostrong Technology"],"content_html":"\u003cp\u003eGoogle’s Threat Intelligence Group identified and disrupted a large-scale botnet known as x.cpe, affecting more than 1.3 million Google-certified Android TV devices. The operation was attributed to Shenzhen-based manufacturer Videostrong Technology, which leveraged a pre-installed backdoor to remotely push malicious modules after device deployment. The malware transformed infected hardware into nodes for residential proxy networks, ad fraud schemes, and local network reconnaissance tools.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eSupply Chain Compromise: Videostrong Technology pre-installs a stub application (com.oemservice) on Android TV hardware during manufacturing.\u003c/li\u003e\n\u003cli\u003eInitial Provisioning: The device is sold and set up by the end-user, connecting to the internet.\u003c/li\u003e\n\u003cli\u003eC2 Beaconing: The stub application initiates contact with attacker-controlled command-and-control servers.\u003c/li\u003e\n\u003cli\u003eDefense Evasion: The stub application disables Google Play Protect to prevent the detection of subsequent malicious payload installation.\u003c/li\u003e\n\u003cli\u003ePayload Deployment: The operator remotely installs modular malware payloads via system-level permissions granted to the stub application.\u003c/li\u003e\n\u003cli\u003eMalicious Execution: Modules execute unauthorized tasks including residential proxy traffic routing, ad fraud, and lateral network probing.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eOver 1.4 million devices were confirmed to be infected, with significant concentrations in Brazil, Malaysia, Iraq, Mexico, and Taiwan, and thousands of affected devices across the US, UK, Germany, Australia, and Canada. The botnet allowed operators to capture device screens, execute terminal commands, and probe local network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Android TV devices within the corporate network, specifically identifying MECOOL-branded and white-label hardware manufactured by Videostrong Technology.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for anomalies originating from Android TV devices, particularly high volumes of outbound traffic characteristic of residential proxy activity.\u003c/li\u003e\n\u003cli\u003eRestrict internal network access for IoT and media streaming devices by isolating them in a dedicated VLAN with strictly enforced egress filtering.\u003c/li\u003e\n\u003cli\u003eImplement device management policies that prohibit the use of unmanaged, consumer-grade Android TV hardware for accessing sensitive corporate resources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T20:42:36Z","date_published":"2026-11-03T18:17:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-x-cpe-botnet/","summary":"The x.cpe botnet, operated by Videostrong Technology, utilized a pre-installed backdoor on over 1.3 million Android TV devices to deploy modular malware, disable security protections, and conduct unauthorized proxying, ad fraud, and network reconnaissance.","title":"Videostrong Technology x.cpe Botnet","url":"https://feed.craftedsignal.io/briefs/2026-11-x-cpe-botnet/"}],"language":"en","title":"CraftedSignal Threat Feed - Android TV Boxes (Including MECOOL Brand)","version":"https://jsonfeed.org/version/1.1"}