Actor Profile

The threat actor is Videostrong Technology Co., a Chinese Android TV box manufacturer attributed with high confidence by Google Threat Intelligence Group as intentionally developing, deploying, and operating the XCPE malware botnet for financial gain. The company embedded persistent backdoors directly into device firmware during manufacturing across multiple device brands and models over several years. Videostrong sold access to criminal affiliates who deployed malicious modules for ad fraud, residential proxy operations, and additional malware distribution. The actor's motivation was revenue generation through a plug-in cybercrime platform that monetized over 1.3 million compromised Android TV streaming boxes.

TTPs (Tactics, Techniques, Procedures)

XCPE employed a modular architecture with backdoor components (x.cpe, com.oemservice) running with Android system-level privileges. Initial persistence was achieved through firmware-level embedding during manufacturing. The malware established C2 communications via anyevonline[.]com domain to obtain MQTT broker credentials (mqtt.szbboys[.]com) for command execution. Key capabilities included silent application installation, disabling Google Play Protect, executing shell commands with system privileges, screenshot capture, keystroke injection, credential harvesting, network reconnaissance, and establishing reverse shells. The operation deployed specialized loaders (com.abc.nexus) and droppers disguised as Android system applications. Affiliate modules included residential proxy services (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer), ad fraud mechanisms, and secondary backdoors (Moyu, Spirit, Bird). The architecture continuously evolved to evade detection.

Targets & Patterns

The primary targets were consumers purchasing Android TV streaming boxes, set-top boxes, and related consumer electronics manufactured by Videostrong. Over 1.3 million Android TV boxes were directly compromised through XCPE, with at least 10 million additional devices affected by related malware families distributed through the same infrastructure. Secondary targets included retail set-top boxes, karaoke machines, and telehealth hardware (not all Android-based). The targeting pattern was indiscriminate, focusing on mass compromise of consumer devices to maximize the botnet's value for residential proxy services and ad fraud operations. Victims unknowingly had their devices used to route third-party internet traffic and generate fraudulent ad revenue, representing a supply chain compromise at the manufacturing level.

Historical Context

Synthient discovered the XCPE malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025, indicating the operation had been active for an extended period. Google's investigation found that Videostrong had been developing and distributing the malware across multiple device brands and models for years, with dedicated infrastructure supporting continuous evolution. In late 2024, Videostrong modified its architecture by introducing the com.abc.nexus loader to separate malicious module execution from C2 communications. Since August 2026, operators further evolved their tactics by replacing the loader with smaller, specialized droppers disguised as Android system applications. The November 2026 disruption involved coordinated action by Google, Japan's National Police Agency, and security firms Lumen, HUMAN Security, Plume, Synthient, and TrendAI, resulting in C2 takedowns affecting over a dozen related malware families and termination of Videostrong's Android TV manufacturing license.

Defensive Recommendations

  • Conduct supply chain security assessments for Android TV boxes and consumer electronics, prioritizing verification of firmware integrity before deployment or resale
  • Monitor network traffic for connections to known XCPE infrastructure domains (anyevonline[.]com, mqtt.szbboys[.]com) and MQTT broker communications from consumer devices
  • Implement network segmentation to isolate IoT and streaming devices from critical systems, limiting potential lateral movement from compromised consumer electronics
  • Deploy behavioral analytics to detect anomalous activity from Android TV devices, including unexpected outbound connections, silent application installations, and system-level command execution
  • Verify Google Play Protect status on Android devices and investigate any instances of disabled security features, as XCPE specifically targeted this protection mechanism