Google has disrupted a botnet involving more than 1.3 million Android devices, most of them TV set-top boxes, after taking legal action against the domains and servers used to control the network in late October.
The company says it is highly confident that Shenzhen-based device maker Videostrong deliberately embedded a backdoor called x.cpe in numerous models and brands over several years, then sold access to criminal operators. Google said the activity did not appear to be the result of an isolated insider or an accidental software flaw.
The backdoor operates as a system application within the firmware and has system-level privileges. It can communicate with command-and-control servers, install applications without the owner's knowledge, run commands, capture screens and map the local network. To enable silent installations, it first disables application checks in Google Play Protect.
Google said it observed operators using the access to capture live screenshots, record keystrokes, collect account information, device data, application lists and system logs, and open reverse shells for remote command-line access. Criminal modules mainly converted the devices into residential proxies or sold their unused bandwidth. Other components were used to falsify online advertising views.
The affected hardware was not limited to Android TV boxes. The backdoor was also found on telehealth equipment, karaoke machines and digital signage. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, while noting that the actual number could be higher. Malaysia, Brazil, Iraq, Mexico and Taiwan recorded the largest numbers, while the United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000 affected devices.
As part of the operation, Google also took down control domains associated with more than a dozen malware families delivered through the backdoor. The Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI contributed to the investigation and disruption.
Google expects the action to block the criminals' access to at least 10 million additional infected devices because the same operators distributed malware through other channels. However, it warned that those behind the operation may quickly adopt new tools after part of their infrastructure is removed.
The x.cpe backdoor remains embedded in affected firmware and returns after a device restarts, meaning owners cannot permanently remove it themselves. TrendAI said cleanup requires action from the vendor, stronger platform protections or replacement of the hardware. Plume recommends a full factory reset because additional backdoors may have been installed, although it does not confirm that the reset removes x.cpe. Synthient advises consumers to dispose of affected devices.
Synthient has published a list of 182 model names associated with the campaign, while warning that a model name alone does not prove infection. Its investigation focused on MECOOL-branded devices linked to Videostrong, including a MECOOL KM9PRO Max that it found with the backdoor preinstalled. Plume identified more than a dozen devices communicating with the botnet's control server, most of them from MECOOL.
For organizations, Synthient recommends identifying potentially affected devices using its indicators, disconnecting and discarding them, blocking the listed control domains and IP addresses, and separating other smart devices from sensitive systems through network segmentation. TrendAI also advises companies with remote workers to treat unmanaged consumer devices on home networks as part of their attack surface and to require managed devices for corporate access.
Google said evidence linking Videostrong to the operation included the backdoor's ability to pass settings from command-and-control servers to other Videostrong applications, including its YokaTV Player. A GitHub account hosting botnet packages used the name yf-videostrong. Synthient cited a document signed by Videostrong's research and development director and an overlap between a Videostrong web domain and the IP address of the operators' control panel. Plume also found that Videostrong supplied both device firmware and remote-management tools.
According to Google, Videostrong concealed the malicious code to bypass compatibility and security checks for certified Android devices, loading it after the device's initial boot. Google has since changed its review process and is improving firmware checks for certified Android TV products.
Google has banned Videostrong, as well as any future subsidiaries or affiliates, from producing or selling certified Android devices and from supplying software to other certified device manufacturers. As of November 2, Videostrong's website still listed products described as Google Certified Android TV Box and Google Certified Android TV Stick. Plume said the botnet affected both Google-certified devices and products running Android Open Source Project software, although Google did not disclose how many certified devices were involved.
Sources: The Hacker News.