Android botnet takedown leaves TV box backdoor intact
An Android botnet, a network of compromised devices controlled remotely, lost access to servers governing more than 1.3 million devices in a Google-led takedown in late October. Most affected devices were Android TV set-top boxes, although the same backdoor was also found in telehealth equipment, karaoke machines and digital signs.
Google says it is highly confident that Shenzhen-based device maker Videostrong deliberately placed the backdoor, called x.cpe, in its products and sold criminal access. A backdoor is a hidden way to enter or control a device without its owner’s permission. Videostrong makes Android TV boxes and other equipment under its own name and for other brands. Google believes the code was embedded across numerous models and brands over several years, rather than introduced by mistake or a rogue employee.
The operation used legal action to seize or disable the domains and servers controlling the botnet. Google also took down control domains associated with more than a dozen malware families, meaning related groups of malicious software installed through x.cpe. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI participated in the operation. Because the criminals distributed the same malware through other routes, Google expects the disruption to remove their access to at least 10 million additional infected devices. It cautioned that backdoor providers and their criminal customers can quickly change tools after infrastructure is disabled.
Google has ended its relationship with Videostrong. It barred the company, as well as future subsidiaries and affiliates, from producing or selling certified Android devices and from providing software to other certified manufacturers.
X.cpe operates inside the firmware, the built-in software that starts and controls a device, as a system app with elevated access. It contacts command-and-control servers, also called C2 servers, which send instructions to infected equipment. Before silently installing software, the backdoor disables checks performed by Google Play Protect, Android’s built-in security feature.
According to Google’s analysis, operators could install apps without notifying the owner, execute commands, capture the screen and map other equipment on the same network. Google says it observed operators taking live screenshots, transmitting keystrokes, extracting account details, device information, installed-app lists and system logs, and opening reverse shells. A reverse shell gives a remote operator a command line through which the device can be controlled.
Most modules, which are add-on programs delivered through the backdoor, converted the boxes into residential proxies or sold their unused bandwidth. A residential proxy routes someone else’s traffic through a household internet connection, making that activity appear to originate from an ordinary home. Other modules generated fraudulent views of online advertisements. This meant owners’ connections could be used for outside traffic and ad fraud without their knowledge.
TrendAI, Trend Micro’s enterprise business unit, counted 1,472,554 infected devices across 206 models from June 3 through October 1 and said the actual total was at least that large. Malaysia, Brazil, Iraq, Mexico and Taiwan had the highest numbers. The United States, Germany, the United Kingdom, Australia and Canada each had approximately 26,000 to 42,000 affected devices.
Synthient published 182 device model names observed during the campaign, but stressed that a matching model name does not by itself prove infection. Its investigation concentrated on MECOOL-branded boxes linked to Videostrong. Synthient purchased a MECOOL KM9PRO Max and found x.cpe already installed. Plume separately identified more than a dozen device types communicating with the botnet’s control server, most carrying the MECOOL brand.
Removing x.cpe is difficult because it is part of the firmware and returns after a restart. TrendAI says it runs as a system app signed with the manufacturer’s key, leaving vendor intervention, platform-level protection or device replacement as the available cleanup paths. Plume recommends a complete factory reset because downloaded modules may have added further backdoors, but it does not state that a reset removes x.cpe. Synthient advises consumers to disconnect and permanently discard affected boxes because of the malware risk.
For organizations, Synthient recommends using its published indicators, meaning technical signs of compromise, to locate MECOOL and similar devices, disconnecting and disposing of devices found, and blocking the listed control domains and IP addresses. It also recommends placing other smart devices on separate network segments, isolated sections of a network kept away from sensitive systems. TrendAI advises employers with remote workers to consider unmanaged consumer equipment on home networks part of their attack surface, the collection of devices and connections that could provide a route into corporate resources, and to restrict corporate access to managed devices.
Google connected x.cpe with other Videostrong software because the backdoor passes settings from its C2 server to apps including the YokaTV Player streaming application. A GitHub account used to host botnet packages was named yf-videostrong. Synthient also reached a high-confidence assessment that Videostrong operated the system, citing a document signed by the company’s research and development director in an openly accessible folder on a botnet server. It also found a Videostrong domain sharing an IP address with the operators’ control panel. Plume found that the company supplied both device firmware and remote-management tools.
The incident also exposed a weakness in Android device approval. Google requires manufacturers to complete compatibility and security testing, but says Videostrong concealed its code to exploit a gap in those checks and installed the malicious component after a device’s first startup. Google has since changed its review process and is strengthening firmware checks for certified Android TV equipment. As of November 2, Videostrong’s website still listed products described as certified Android TV boxes and sticks.
Plume found both Google-certified devices and products running the Android Open Source Project (AOSP), the freely available foundation of Android, inside the botnet. Google did not state how many certified devices were affected. That differs from the BadBox 2.0 botnet involved in Google’s July 2025 lawsuit, whose more than 10 million devices were uncertified.
For businesses dealing with broader device and network risk, AEU-I offers security-first IT, infrastructure and consulting. For affected owners, however, the central limitation remains physical and immediate: taking down the botnet servers disrupted control, but it did not remove x.cpe from the boxes themselves.