XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google

Key facts for XCPE Android botnet

Detection coverage for XCPE Android botnet

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5057 across Splunk SPL, Microsoft KQL and Sigma, covering 87 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XCPE Set-Top Box HTTP Bootstrap to anyevonline.com / szbboys.com (/router/config on :8000)

Behaviour-first detection of the XCPE (x.cpe / com.oemservice) firmware backdoor stage-1 bootstrap from threat TL-2026-5057. Infected Android TV boxes POST to /router/config/mqtt, /router/config/acs and /router/config/app on TCP 8000 (hostnames under anyevonline.com, e.g. mcstb.anyevonline.com, or szbboys.com) to fetch MQTT broker details, the ott.szbboys.com upload URL and module configuration, then upload telemetry to /cpe/file/upload. The URI and port pattern fires even if operators rotate domains; known XCPE infrastructure (38.145.197.135, 219.134.163.210/211) is flagged for triage.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1571, T1195.002
• Data sources: zeek, network_proxy, firewall
• Severity: high
• Confidence: high

Splunk SPL

index=zeek sourcetype="bro:http:json" earliest=-24h method=POST (uri="/router/config/mqtt*" OR uri="/router/config/acs*" OR uri="/router/config/app*" OR uri="/cpe/file/upload*")
| rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip, "id.resp_p" as dest_port
| where dest_port=8000
| eval known_xcpe_infra=if(match(host, "(^|[.])(anyevonline[.]com|szbboys[.]com|yokatvonline[.]com|intermedia-arts[.]tv)$") OR match(dest_ip, "^(38[.]145[.]197[.]135|219[.]134[.]163[.]21[01])$"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(host) as hosts values(known_xcpe_infra) as known_xcpe_infra by src_ip, dest_ip, dest_port
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Microsoft KQL

let xcpe_ips = dynamic(["38.145.197.135", "219.134.163.210", "219.134.163.211"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST" and DestinationPort == 8000
| where RequestURL has_any ("/router/config/mqtt", "/router/config/acs", "/router/config/app", "/cpe/file/upload")
| extend KnownXcpeInfra = iff(DestinationIP in (xcpe_ips) or RequestURL matches regex @"(?i)(anyevonline[.]com|szbboys[.]com|yokatvonline[.]com|intermedia-arts[.]tv)", "yes", "no")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, DestinationIP, DestinationPort, KnownXcpeInfra
| order by Hits desc

Sigma

title: XCPE Android Set-Top Box HTTP Bootstrap Config Request
id: 5b7c1e0a-3f4d-4a52-9c1e-0d57a1c80101
status: experimental
description: Detects the XCPE (x.cpe / com.oemservice) stage-1 HTTP bootstrap, a POST to /router/config/mqtt, /router/config/acs or /router/config/app (typically on TCP 8000 against anyevonline.com or szbboys.com) or the /cpe/file/upload exfiltration endpoint. TL-2026-5057.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1571
    - attack.initial-access
    - attack.t1195.002
logsource:
    category: proxy
detection:
    selection_method:
        cs-method: 'POST'
    selection_uri:
        c-uri|contains:
            - '/router/config/mqtt'
            - '/router/config/acs'
            - '/router/config/app'
            - '/cpe/file/upload'
    selection_port:
        c-uri|contains: ':8000/'
    selection_host:
        cs-host|endswith:
            - '.anyevonline.com'
            - '.szbboys.com'
            - '.yokatvonline.com'
            - '.intermedia-arts.tv'
    condition: selection_method and selection_uri and (selection_port or selection_host)
falsepositives:
    - Unrelated IoT or router management software that happens to use /router/config/ paths on port 8000
    - Internal vendor management portals using the same URI layout
level: high

Known false positives:

• Unrelated IoT/router management software using /router/config/ paths on TCP 8000
• Internal vendor management portals with a similar REST layout

Tuning notes: Point index/sourcetype at your HTTP telemetry (Zeek bro:http:json, a proxy, or the Splunk CIM Web model). Restrict src_ip to IoT/set-top-box VLANs to cut noise, and allowlist internal management hosts. Rows with known_xcpe_infra=yes are high confidence; rows with no are still anomalous. Plain HTTP only: HTTPS bootstrap needs TLS inspection or the DNS detections.

• 🔒 XCPE Core and Fallback C2 Domain Resolution ([indicator], [indicator], [indicator], [indicator]) · unlock with TL Creds
• 🔒 XCPE Privileged System-App Install and Module Files (priv-app, privapp-permissions, libexploit.so) · unlock with TL Creds
• 🔒 XCPE Affiliate Module C2: Residential Proxy, Ad-Fraud and Backdoor Domains · unlock with TL Creds
• 🔒 XCPE Module Staging: Downloads from Operator GitHub Accounts and Staging IPs · unlock with TL Creds
• 🔒 XCPE Dropper Timestomping (persist.networkstack.*) and priv-app Copy Commands · unlock with TL Creds
• 🔒 XCPE C2-Driven Remote Shell, Screen Capture/Key Injection and libtraceroute Recon · unlock with TL Creds
• 🔒 XCPE Post-Exploitation: Play Protect Disabled and ADB Root / System Remount · unlock with TL Creds
• 🔒 XCPE MQTT C2 Channel: Non-Standard Ports 3885-3887 and Known Broker/Staging IPs · unlock with TL Creds

Indicators of compromise for XCPE Android botnet

As of 2026-11-03, Threadlinqs Intelligence tracks 87 indicators of compromise for TL-2026-5057.

Sample indicators (3 of 87)

• IP address: 219.134.163[.]210
• Domain: szbboys[.]com
• URL: hxxps://github[.]com/yf-videostrong/

Defanged, TLP:CLEAR. Full set of 87 indicators: unlock with TL Creds.

How XCPE Android botnet works

On 2026-11-02 Google took down the C2 domains and servers and banned Videostrong from building certified Android devices; the action is expected to cut off access to at least 10 million additional devices compromised by affiliate modules.

Google Threat Intelligence Group reports that XCPE is a firmware-level backdoor intentionally developed and operated by Videostrong Technology Co. for financial gain. The primary component, x.cpe (package name x.cpe or com.oemservice in some builds), is preloaded in the firmware, runs as android.uid.system, and is reinstalled from the /oem/ partition on reboot if a user removes it. It exports ContentProviders holding runtime configuration (content://com.release.debug.provider/configs and ShareProvider com.oem.share.provider) and co-exists with the YokaTV Player software on affected boxes.

C2 is two-stage. Stage 1 is an HTTP bootstrap (POST /router/config/mqtt, /router/config/acs, /router/config/app) against *.anyevonline[.]com:8000, where the hostname is derived from a private_url provider value or from the ro.mecool.device system property (mcstb.anyevonline.com for Mecool devices, otherwise stb[AndroidVersion][Type].anyevonline.com). The responses deliver MQTT broker details, a file upload URL on ott.szbboys[.]com, geolocation/STUN settings, ad-module flags and module configuration. Stage 2 is a persistent MQTT channel to mqtt.szbboys[.]com on non-standard ports 3885-3887 (library x.cpe.mqtt.MqttUtils, topic structure /device/{model}/{chipId}/{action}; module configuration is pushed on ext/lib/config and acknowledged on ext/lib/config/reply). MQTT commands support silent APK installation, arbitrary shell execution under the system UID, shell-script download and execution (x.cpe.util.RunCmds), remote-desktop style key injection (Instrumentation.sendKeyDownUpSync) and screen capture (SurfaceControl.screenshot), and network reconnaissance via an embedded libtraceroute.so (ping, traceroute, WHOIS AS lookups). The backdoor disables Google Play Protect by setting package_verifier_user_consent to -1 (AppUtils.disablePackageVerify). Observed exfiltration includes account and device information, package inventories, system logs, hardware telemetry (serial, MAC, model, firmware version), screenshots and bandwidth metrics. Fallback C2 domains intermedia-arts[.]tv and yokatvonline[.]com are used by system-package variants. Operator management traffic was observed to an EMQX broker (HTTP API 8082, WebSocket 8083, admin console 18083).

x.cpe feeds a loader, com.abc.nexus (CoreService, BootReceiver, RemoteMessageHandler), which unpacks the anti-analysis library libseccomp_guard.so (seccomp-based protections that block thread pausing/termination, cross-process interference and child-process spawning) and deploys monetization modules as native ELF daemons, embedded SDKs, or dynamically downloaded droppers and APKs. Resource constraints (CPU, memory, I/O) and per-region server pools are pushed with module configs, and modules are enabled or disabled per device by libCode. Modules are staged on eleven operator-controlled GitHub accounts, filemail[.]com, and servers at 38.145.197.135 and 23.94.49.57. Modules include residential-proxy/bandwidth-sharing components (Linkfog, Jaguar, AppSalt/Honeygain SDK, BWM/IPWeb, GaGaNode with NetNut/PopaNet and EarnFM, Traffmonetizer), backdoors (Spirit, Moyu, Bird, Fission) and the HiddenView ad-fraud app (com.ota.service). Moyu and Bird were previously associated with BadBox. Several proxy SDKs are silently opted in without user consent (AppSalt optIn() without UI) and stop if installed from Google Play.

The backdoor has been active since at least late 2024, when Videostrong evolved single-stage droppers into a modular three-stage architecture. From August 2026 com.abc.nexus was mass-uninstalled and replaced with tailored dropper packages (e.g. com.android.system.ntp, com.android.sso.auth.handler) delivered over the MQTT channel that extract libexploit.so, call nativeAdbRoot()/nativeAdbShell() to restart adbd as root, remount /system read-write, copy the module into /system/priv-app/ with a /system/etc/permissions/privapp-permissions-<app>.xml granting INSTALL_PACKAGES and REBOOT, and use persist.networkstack.* properties (uninstall, skip_system_install, install_time) to control cleanup and timestomp the install time to match system apps. Affected devices are primarily Android TV set-top boxes and white-label ODM variants (including Mecool-related builds), with telehealth devices, karaoke machines and digital signage also observed. Google's response included takedown of 50+ C2 domains and servers for XCPE and 12+ affiliate malware families, a ban on Videostrong and affiliates from building certified Android devices or supplying software to certified vendors, and hardened firmware-integrity checks and CTS review for certified Android TV devices. Partners named: Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. No CVE is cited; the compromise is a deliberate firmware-level supply-chain implant. BeaconBeagle correlation was attempted for 219.134.163.210 but the service returned HTTP 502, so no third-party C2 correlation is recorded.

MITRE ATT&CK techniques by tactic:

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1437.001 Application Layer Protocol: Web Protocols; T1521 Encrypted Channel; T1544 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1418 Software Discovery; T1422 System Network Configuration Discovery; T1426 System Information Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1629.003 Disable or Modify Tools; T1633.001 System Checks; T1655.001 Match Legitimate Name or Location

Collection

T1056 Input Capture; T1113 Screen Capture; T1414 Clipboard Data; T1513 Screen Capture

Execution

T1059.004 Unix Shell; T1575 Native API; T1623.001 Command and Scripting Interpreter: Unix Shell

Initial Access

T1195.002 Compromise Software Supply Chain; T1195.003 Compromise Hardware Supply Chain

Persistence

T1398 Boot or Logon Initialization Scripts; T1624.001 Event Triggered Execution: Broadcast Receivers

Privilege Escalation

T1404 Exploitation for Privilege Escalation; T1626 Abuse Elevation Control Mechanism

Impact

T1496.002 Bandwidth Hijacking; T1643 Generate Traffic from Victim

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.006 Web Services; T1608.001 Upload Malware

defense-evasion

T1604 Proxy Through Victim

Exfiltration

T1646 Exfiltration Over C2 Channel

defense-impairment

T1685 Disable or Modify Tools

Remediation for XCPE Android botnet

Patches

• No CVE or vendor patch; Google removed C2 infrastructure and banned the vendor from certified Android devices

Immediate actions

• Block XCPE and affiliate C2 domains and IPs (szbboys.com, anyevonline.com, intermedia-arts.tv, yokatvonline.com, 219.134.163.210/211, 38.145.197.135, 23.94.49.57) at DNS and perimeter
• Alert on MQTT traffic to TCP ports 3885-3887 and HTTP bootstrap to port 8000 from set-top boxes and IoT segments
• Hunt for packages x.cpe, com.oemservice, com.abc.nexus, com.android.system.ntp, com.android.sso.auth.handler and com.ota.service on Android TV and IoT fleets
• Isolate suspected Videostrong-sourced set-top boxes on a segregated network

Workarounds

• Factory reset suspect devices (may not remove firmware-resident components)
• Ensure Google Play Protect is enabled
• Do not install bandwidth-sharing apps
• Replace affected boxes with certified devices

Longer-term hardening

• Require independent security audits of ODM/OEM firmware before deployment
• Delist Videostrong and its variants from approved vendor lists and purchase only from Android TV certified partners
• Re-audit preloaded apps and firmware on deployed devices
• Monitor for suspicious GitHub release downloads and residential-proxy/bandwidth-sharing traffic from consumer devices

Affected and fixed versions

• Videostrong Technology Co. — Android TV set-top boxes and other Android IoT devices (white-label ODM firmware, including Mecool-related builds)
  Vulnerable versions: Firmware preloaded with x.cpe / com.oemservice

Timeline of XCPE Android botnet

Last updated 2026-11-03 · 5 updates · revalidated 5× · latest source

• 2024-12-01 XCPE backdoor active in Videostrong firmware since at least late 2024 (month approximate; source states 'late 2024')
• 2024-12-02 Videostrong evolved single-stage droppers into a modular three-stage architecture (locked-ioc-86 plus locked-ioc-59 loader plus monetization modules), possibly responding to earlier BadBox enforcement (date approximate, 'late 2024')
• 2025-07-17 Operator GitHub release lw_android_agent_special_ndk_32_20250717 (Linkfog armeabi-v7a module) carries a 20250717 build stamp, showing module builds were staged on GitHub in mid-2025
• 2025-07-17 Google announced legal action against the BadBox 2.0 botnet of 10M+ uncertified Android devices, a precedent for the XCPE action; Moyu and Bird modules were previously BadBox-associated
• 2025-08-06 Observed MQTT module configuration pushed to a device in Iraq assigned serverPool Pool5 with lastUpdated 2025-08-06, enabling only the Linkfog module
• 2025-12-01 XCPE reportedly discovered preinstalled on a MECOOL KM9PRO Max Android TV box (month approximate; source states 'late 2025').
• 2026-06-03 Start of the 3 June - 1 October 2026 window in which 3.8 million distinct home and mobile IP addresses were documented as XCPE-infected (per The Register).
• 2026-07-01 FBI seized domains of the NetNut-linked Popa botnet (month approximate, July 2026); the same NetNut/Popanet SDK appears as an XCPE affiliate module.
• 2026-08-01 From August 2026 operators mass-uninstalled locked-ioc-59 and deployed tailored droppers (locked-ioc-30, locked-ioc-25) via MQTT using libexploit.so ADB-root to install modules into /system/priv-app (day approximate; source states 'August 2026')
• 2026-10-01 Plume Security Labs published its XCPE botnet whitepaper (October 2026; exact day not verified).
• 2026-10-01 TrendAI counted 1,472,554 XCPE-infected devices across 206 models between 3 June and 1 October 2026, concentrated in Malaysia, Brazil, Iraq, Mexico and Taiwan (end of measurement window)
• 2026-11-02 Google published 'Shutting the Door on the XCPE Botnet' with IOCs for XCPE and affiliate modules; 1.3M+ set-top boxes infected and 10M+ further devices expected to lose access
• 2026-11-02 Google banned Videostrong and affiliates from building certified Android devices or supplying software to certified vendors, and hardened firmware-integrity checks and CTS review for Android TV
• 2026-11-02 Google Threat Intelligence Group, with Japan NPA, Lumen, HUMAN Security, Plume, Synthient and TrendAI, took down 50+ C2 domains and servers for XCPE and 12+ affiliate malware families

Update history

• 2026-11-03 — XCPE Botnet: 1.3M Pre-Infected Android TV Boxes and Other Devices Turned into Residential Proxies (Videostrong) - Disrupted: What changed No change to severity (HIGH), exploitability (ACTIVE), status (MONITORING) or attribution; the newer report restates the same facts with a few additions. New indicators (6) Indicator values are withheld at this access level. Ne
• 2026-11-02 — XCPE Botnet: Pre-installed locked-ioc-86 Firmware Backdoor on Videostrong Certified Android TV Devices Disrupted by Google: What changed No severity, exploitability, status or attribution change; the existing record already reflects HIGH / ACTIVE / MONITORING with Videostrong at HIGH confidence. New indicators (9) Indicator values are withheld at this access lev
• 2026-11-02 — XCPE Android TV Box Botnet (1.3M Devices) Disrupted; Preinstalled locked-ioc-86 Firmware Backdoor Attributed to Videostrong Technology: What changed No severity, exploitability or status change (HIGH / ACTIVE / MONITORING stay as is). nation_state Unknown - China, based on the report describing Videostrong as a Shenzhen-based OEM/ODM, with locked-ioc-56 sharing an IP with t
• 2026-11-02 — XCPE Android TV Box Botnet (1.3M+ devices) Preinstalled via Videostrong Firmware; Google Disrupts Botnet and Bans Manufacturer: What changed No field changes. Severity HIGH, exploitability ACTIVE and attribution (Videostrong, HIGH confidence) are unchanged. The existing status MONITORING is kept because the takedown has already occurred. New indicators (2) Indicator
• 2026-11-02 — locked-ioc-86 (XCPE) Android TV Box Botnet (1.3M Devices) Disrupted by Google; Vendor Videostrong Alleged to Have Sold Backdoor Access: What changed No severity, exploitability or status change (already HIGH / ACTIVE / MONITORING). Adds independent scale telemetry: TrendAI counted 1,472,554 devices across 206 models (3 Jun - 1 Oct 2026), above Google's 1.3M+ figure; geograp

Sources cited for XCPE Android botnet

• Shutting the Door on the XCPE Botnet (Google Threat Intelligence Group) Google Cloud · Vendor report · 2026-11-02
• Google: Taking legal action against the BadBox 2.0 botnet Google · Vendor report · 2025-07-17
• Android TV Certified Partners android.com · Vendor report · 2026-11-02
• Google sues 25 alleged BadBox 2.0 botnet operators, all of whom are in China (The Register) The Register · News · 2025-07-17
• Google Sues Operators of a 10 Million Device Android Set-Top Box Botnet (TorrentFreak) torrentfreak.com · News · 2025-07-21

More in supply chain

• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)
• Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)
• Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
• Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages