{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/telehealth-devices/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Videostrong"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Android TV set-top boxes","Telehealth devices","Karaoke machines","Digital signage"],"_cs_severities":["high"],"_cs_tags":["supply-chain","botnet","android","firmware","residential-proxy"],"_cs_type":"threat","_cs_vendors":["Videostrong"],"content_html":"\u003cp\u003eGoogle identified and disrupted a global botnet consisting of over 1.3 million infected Android devices, primarily TV set-top boxes, but also including telehealth devices, karaoke machines, and digital signage. The operation involved a persistent backdoor named x.cpe, which is embedded directly into the device firmware with system-level privileges. Google has confirmed that the manufacturer, Videostrong, intentionally implemented this backdoor, which was used to facilitate ad fraud and establish residential proxy networks. The backdoor can disable Google Play Protect, execute arbitrary commands, capture screens, and exfiltrate system data. Due to its firmware-level integration and use of manufacturer-signed system apps, the backdoor persists across factory resets.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eManufacturing: Videostrong embeds the x.cpe backdoor into device firmware during the production process.\u003c/li\u003e\n\u003cli\u003eInitial Access: The backdoor is pre-installed on devices distributed to consumers and organizations.\u003c/li\u003e\n\u003cli\u003eEvasion: Upon boot, the backdoor disables Google Play Protect to facilitate silent installation of malicious modules.\u003c/li\u003e\n\u003cli\u003eCommand and Control: The backdoor contacts C2 servers, passing system information and awaiting instructions.\u003c/li\u003e\n\u003cli\u003eExploitation: Remote operators deploy modules to the device, enabling residential proxy services or ad fraud operations.\u003c/li\u003e\n\u003cli\u003eExfiltration: Operators capture screen content, keystrokes, and account details through remote shells or screen scraping.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eOver 1.3 million devices were confirmed to be part of the botnet, with infections detected across 206 models. The backdoor provides remote operators with full system access, allowing for the misuse of home internet bandwidth for residential proxy networks and unauthorized ad generation. The backdoor poses a persistent risk to corporate networks where these devices are connected, potentially serving as a pivot point.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Android TV boxes and similar consumer IoT devices within your environment, specifically identifying those manufactured by or rebranded from Videostrong (e.g., MECOOL).\u003c/li\u003e\n\u003cli\u003eImmediately isolate identified consumer Android devices from sensitive network segments or corporate infrastructure.\u003c/li\u003e\n\u003cli\u003ePrioritize the replacement of devices identified as potentially infected, as firmware-level remediation is not feasible for the end-user.\u003c/li\u003e\n\u003cli\u003eImplement network-level egress filtering to block traffic to known botnet control domains and IPs used by the x.cpe infrastructure.\u003c/li\u003e\n\u003cli\u003eTreat all unmanaged consumer smart devices on home networks as untrusted; enforce the use of VPNs or managed endpoints for all corporate remote access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T17:48:56Z","date_published":"2026-11-02T17:48:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-videostrong-backdoor/","summary":"Google disrupted a botnet of over 1.3 million Android devices, including TV set-top boxes, found to contain a persistent firmware-level backdoor intentionally installed by manufacturer Videostrong.","title":"Videostrong Android device firmware backdoor (x.cpe)","url":"https://feed.craftedsignal.io/briefs/2026-11-videostrong-backdoor/"}],"language":"en","title":"CraftedSignal Threat Feed - Telehealth Devices","version":"https://jsonfeed.org/version/1.1"}