Attack Chain

1. Manufacturing: Videostrong embeds the x.cpe backdoor into device firmware during the production process.
2. Initial Access: The backdoor is pre-installed on devices distributed to consumers and organizations.
3. Evasion: Upon boot, the backdoor disables Google Play Protect to facilitate silent installation of malicious modules.
4. Command and Control: The backdoor contacts C2 servers, passing system information and awaiting instructions.
5. Exploitation: Remote operators deploy modules to the device, enabling residential proxy services or ad fraud operations.
6. Exfiltration: Operators capture screen content, keystrokes, and account details through remote shells or screen scraping.

Impact

Over 1.3 million devices were confirmed to be part of the botnet, with infections detected across 206 models. The backdoor provides remote operators with full system access, allowing for the misuse of home internet bandwidth for residential proxy networks and unauthorized ad generation. The backdoor poses a persistent risk to corporate networks where these devices are connected, potentially serving as a pivot point.

Recommendation

• Inventory all Android TV boxes and similar consumer IoT devices within your environment, specifically identifying those manufactured by or rebranded from Videostrong (e.g., MECOOL).
• Immediately isolate identified consumer Android devices from sensitive network segments or corporate infrastructure.
• Prioritize the replacement of devices identified as potentially infected, as firmware-level remediation is not feasible for the end-user.
• Implement network-level egress filtering to block traffic to known botnet control domains and IPs used by the x.cpe infrastructure.
• Treat all unmanaged consumer smart devices on home networks as untrusted; enforce the use of VPNs or managed endpoints for all corporate remote access.