# XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google

> The XCPE backdoor, preloaded into firmware by Android OEM/ODM Videostrong Technology Co., infected more than 1.3 million Android TV set-top boxes and other Android IoT devices and enrolled them in a botnet monetized through residential proxy exit nodes, ad fraud and secondary backdoors. On 2026-11-02 Google took down the C2 domains and servers and banned Videostrong from building certified Android devices; the action is expected to cut off access to at least 10 million additional devices compromised by affiliate modules.

- **Published:** 2026-11-02T13:38:32Z
- **Last reviewed:** 2026-11-03T19:48:47.422Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5057
- **ID:** TL-2026-5057
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** Videostrong Technology Co. (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 90 (3 shown free below)

## Description

Google Threat Intelligence Group reports that XCPE is a firmware-level backdoor intentionally developed and operated by Videostrong Technology Co. for financial gain. The primary component, x.cpe (package name x.cpe or com.oemservice in some builds), is preloaded in the firmware, runs as android.uid.system, and is reinstalled from the /oem/ partition on reboot if a user removes it. It exports ContentProviders holding runtime configuration (content://com.release.debug.provider/configs and ShareProvider com.oem.share.provider) and co-exists with the YokaTV Player software on affected boxes.

C2 is two-stage. Stage 1 is an HTTP bootstrap (POST /router/config/mqtt, /router/config/acs, /router/config/app) against *.anyevonline[.]com:8000, where the hostname is derived from a private_url provider value or from the ro.mecool.device system property (mcstb.anyevonline.com for Mecool devices, otherwise stb[AndroidVersion][Type].anyevonline.com). The responses deliver MQTT broker details, a file upload URL on ott.szbboys[.]com, geolocation/STUN settings, ad-module flags and module configuration. Stage 2 is a persistent MQTT channel to mqtt.szbboys[.]com on non-standard ports 3885-3887 (library x.cpe.mqtt.MqttUtils, topic structure /device/{model}/{chipId}/{action}; module configuration is pushed on ext/lib/config and acknowledged on ext/lib/config/reply). MQTT commands support silent APK installation, arbitrary shell execution under the system UID, shell-script download and execution (x.cpe.util.RunCmds), remote-desktop style key injection (Instrumentation.sendKeyDownUpSync) and screen capture (SurfaceControl.screenshot), and network reconnaissance via an embedded libtraceroute.so (ping, traceroute, WHOIS AS lookups). The backdoor disables Google Play Protect by setting package_verifier_user_consent to -1 (AppUtils.disablePackageVerify). Observed exfiltration includes account and device information, package inventories, system logs, hardware telemetry (serial, MAC, model, firmware version), screenshots and bandwidth metrics. Fallback C2 domains intermedia-arts[.]tv and yokatvonline[.]com are used by system-package variants. Operator management traffic was observed to an EMQX broker (HTTP API 8082, WebSocket 8083, admin console 18083).

x.cpe feeds a loader, com.abc.nexus (CoreService, BootReceiver, RemoteMessageHandler), which unpacks the anti-analysis library libseccomp_guard.so (seccomp-based protections that block thread pausing/termination, cross-process interference and child-process spawning) and deploys monetization modules as native ELF daemons, embedded SDKs, or dynamically downloaded droppers and APKs. Resource constraints (CPU, memory, I/O) and per-region server pools are pushed with module configs, and modules are enabled or disabled per device by libCode. Modules are staged on eleven operator-controlled GitHub accounts, filemail[.]com, and servers at 38.145.197.135 and 23.94.49.57. Modules include residential-proxy/bandwidth-sharing components (Linkfog, Jaguar, AppSalt/Honeygain SDK, BWM/IPWeb, GaGaNode with NetNut/PopaNet and EarnFM, Traffmonetizer), backdoors (Spirit, Moyu, Bird, Fission) and the HiddenView ad-fraud app (com.ota.service). Moyu and Bird were previously associated with BadBox. Several proxy SDKs are silently opted in without user consent (AppSalt optIn() without UI) and stop if installed from Google Play.

The backdoor has been active since at least late 2024, when Videostrong evolved single-stage droppers into a modular three-stage architecture. From August 2026 com.abc.nexus was mass-uninstalled and replaced with tailored dropper packages (e.g. com.android.system.ntp, com.android.sso.auth.handler) delivered over the MQTT channel that extract libexploit.so, call nativeAdbRoot()/nativeAdbShell() to restart adbd as root, remount /system read-write, copy the module into /system/priv-app/ with a /system/etc/permissions/privapp-permissions-<app>.xml granting INSTALL_PACKAGES and REBOOT, and use persist.networkstack.* properties (uninstall, skip_system_install, install_time) to control cleanup and timestomp the install time to match system apps. Affected devices are primarily Android TV set-top boxes and white-label ODM variants (including Mecool-related builds), with telehealth devices, karaoke machines and digital signage also observed. Google's response included takedown of 50+ C2 domains and servers for XCPE and 12+ affiliate malware families, a ban on Videostrong and affiliates from building certified Android devices or supplying software to certified vendors, and hardened firmware-integrity checks and CTS review for certified Android TV devices. Partners named: Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. No CVE is cited; the compromise is a deliberate firmware-level supply-chain implant. BeaconBeagle correlation was attempted for 219.134.163.210 but the service returned HTTP 502, so no third-party C2 correlation is recorded.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1583.006 Web Services
- T1608.001 Upload Malware
- T1059.004 Unix Shell
- T1575 Native API
- T1398 Boot or Logon Initialization Scripts
- T1404 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1629.003 Disable or Modify Tools
- T1070.006 Timestomp
- T1036.005 Match Legitimate Resource Name or Location
- T1655.001 Match Legitimate Name or Location
- T1633.001 System Checks
- T1018 Remote System Discovery
- T1426 System Information Discovery
- T1113 Screen Capture
- T1414 Clipboard Data
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1008 Fallback Channels
- T1090 Proxy
- T1604 Proxy Through Victim
- T1496.002 Bandwidth Hijacking
- T1027 Obfuscated Files or Information
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1056 Input Capture
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1626 Abuse Elevation Control Mechanism
- T1406 Obfuscated Files or Information
- T1407 Download New Code at Runtime
- T1513 Screen Capture
- T1437.001 Application Layer Protocol: Web Protocols
- T1521 Encrypted Channel
- T1544 Ingress Tool Transfer
- T1643 Generate Traffic from Victim

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**XCPE Set-Top Box HTTP Bootstrap to anyevonline.com / szbboys.com (/router/config on :8000)** (`TL-2026-5057-SPL-001`)

Behaviour-first detection of the XCPE (x.cpe / com.oemservice) firmware backdoor stage-1 bootstrap from threat TL-2026-5057. Infected Android TV boxes POST to /router/config/mqtt, /router/config/acs and /router/config/app on TCP 8000 (hostnames under anyevonline.com, e.g. mcstb.anyevonline.com, or szbboys.com) to fetch MQTT broker details, the ott.szbboys.com upload URL and module configuration, then upload telemetry to /cpe/file/upload. The URI and port pattern fires even if operators rotate domains; known XCPE infrastructure (38.145.197.135, 219.134.163.210/211) is flagged for triage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1571, T1195.002
- **Data sources:** zeek, network_proxy, firewall
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=zeek sourcetype="bro:http:json" earliest=-24h method=POST (uri="/router/config/mqtt*" OR uri="/router/config/acs*" OR uri="/router/config/app*" OR uri="/cpe/file/upload*")
| rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip, "id.resp_p" as dest_port
| where dest_port=8000
| eval known_xcpe_infra=if(match(host, "(^|[.])(anyevonline[.]com|szbboys[.]com|yokatvonline[.]com|intermedia-arts[.]tv)$") OR match(dest_ip, "^(38[.]145[.]197[.]135|219[.]134[.]163[.]21[01])$"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(host) as hosts values(known_xcpe_infra) as known_xcpe_infra by src_ip, dest_ip, dest_port
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
```

### Microsoft KQL

```kql
let xcpe_ips = dynamic(["38.145.197.135", "219.134.163.210", "219.134.163.211"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST" and DestinationPort == 8000
| where RequestURL has_any ("/router/config/mqtt", "/router/config/acs", "/router/config/app", "/cpe/file/upload")
| extend KnownXcpeInfra = iff(DestinationIP in (xcpe_ips) or RequestURL matches regex @"(?i)(anyevonline[.]com|szbboys[.]com|yokatvonline[.]com|intermedia-arts[.]tv)", "yes", "no")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, DestinationIP, DestinationPort, KnownXcpeInfra
| order by Hits desc
```

### Sigma

```yaml
title: XCPE Android Set-Top Box HTTP Bootstrap Config Request
id: 5b7c1e0a-3f4d-4a52-9c1e-0d57a1c80101
status: experimental
description: Detects the XCPE (x.cpe / com.oemservice) stage-1 HTTP bootstrap, a POST to /router/config/mqtt, /router/config/acs or /router/config/app (typically on TCP 8000 against anyevonline.com or szbboys.com) or the /cpe/file/upload exfiltration endpoint. TL-2026-5057.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1571
    - attack.initial-access
    - attack.t1195.002
logsource:
    category: proxy
detection:
    selection_method:
        cs-method: 'POST'
    selection_uri:
        c-uri|contains:
            - '/router/config/mqtt'
            - '/router/config/acs'
            - '/router/config/app'
            - '/cpe/file/upload'
    selection_port:
        c-uri|contains: ':8000/'
    selection_host:
        cs-host|endswith:
            - '.anyevonline.com'
            - '.szbboys.com'
            - '.yokatvonline.com'
            - '.intermedia-arts.tv'
    condition: selection_method and selection_uri and (selection_port or selection_host)
falsepositives:
    - Unrelated IoT or router management software that happens to use /router/config/ paths on port 8000
    - Internal vendor management portals using the same URI layout
level: high

```

**Known false positives:**

- Unrelated IoT/router management software using /router/config/ paths on TCP 8000
- Internal vendor management portals with a similar REST layout

**Tuning notes:** Point index/sourcetype at your HTTP telemetry (Zeek bro:http:json, a proxy, or the Splunk CIM Web model). Restrict src_ip to IoT/set-top-box VLANs to cut noise, and allowlist internal management hosts. Rows with known_xcpe_infra=yes are high confidence; rows with no are still anomalous. Plain HTTP only: HTTPS bootstrap needs TLS inspection or the DNS detections.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- XCPE Core and Fallback C2 Domain Resolution ([indicator], [indicator], [indicator], [indicator]) (locked: unlock with TL Creds)
- XCPE Privileged System-App Install and Module Files (priv-app, privapp-permissions, libexploit.so) (locked: unlock with TL Creds)
- XCPE Affiliate Module C2: Residential Proxy, Ad-Fraud and Backdoor Domains (locked: unlock with TL Creds)
- XCPE Module Staging: Downloads from Operator GitHub Accounts and Staging IPs (locked: unlock with TL Creds)
- XCPE Dropper Timestomping (persist.networkstack.*) and priv-app Copy Commands (locked: unlock with TL Creds)
- XCPE C2-Driven Remote Shell, Screen Capture/Key Injection and libtraceroute Recon (locked: unlock with TL Creds)
- XCPE Post-Exploitation: Play Protect Disabled and ADB Root / System Remount (locked: unlock with TL Creds)
- XCPE MQTT C2 Channel: Non-Standard Ports 3885-3887 and Known Broker/Staging IPs (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 90)

Defanged, TLP:CLEAR.

- IP address: `219.134.163[.]210`
- Domain: `szbboys[.]com`
- URL: `hxxps://github[.]com/yf-videostrong/`

Full set of 90 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Shutting the Door on the XCPE Botnet (Google Threat Intelligence Group)](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/)
- [Google: Taking legal action against the BadBox 2.0 botnet](https://blog.google/innovation-and-ai/technology/safety-security/google-taking-legal-action-against-the-badbox-20-botnet/)
- [Google sues 25 alleged BadBox 2.0 botnet operators, all of whom are in China (The Register)](https://www.theregister.com/2025/07/17/google_sues_25_unnamed_chinese/)
- [Google Sues Operators of a 10 Million Device Android Set-Top Box Botnet (TorrentFreak)](https://torrentfreak.com/google-sues-operators-of-a-10-million-device-android-set-top-box-botnet-250721/)
- [Android TV Certified Partners](https://www.android.com/certified/partners/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5057