Affected Systems

Over 1.3 million Android TV set-top boxes (primarily MECOOL brand), plus telehealth devices, karaoke machines, and digital signage. 206 device models confirmed infected with x.cpe backdoor firmware. Videostrong manufactured devices over multiple years. Highest concentrations in Malaysia, Brazil, Iraq, Mexico, Taiwan; 26,000-42,000 devices each in US, Germany, UK, Australia, Canada.

Exploitation Status

Active exploitation confirmed. Google disrupted botnet infrastructure in late October 2024. Backdoor (x.cpe) remains embedded in device firmware and cannot be removed by users. Google attributes intentional backdoor placement to Videostrong with high confidence. Criminals used access for ad fraud, residential proxy networks, bandwidth theft, and traffic hijacking. Backdoor operators expected to pivot to new infrastructure quickly.

Business Impact

Compromised devices function as residential proxies, exposing organizations to traffic hijacking, credential theft, and network reconnaissance. Backdoor has system-level access, disables Google Play Protect, installs apps silently, captures screenshots, logs keystrokes, extracts account details, and opens reverse shells. Devices cannot be remediated through software updates—firmware-level compromise requires device replacement. Remote workforce using personal Android TV boxes on home networks creates unmanaged attack surface for corporate access. Google has permanently banned Videostrong from Android certification program.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Scan networks using Synthient's published IoCs to identify MECOOL-branded or other Videostrong devices (182 model names listed); physically disconnect and replace any found
  • Block botnet C2 domains and IP addresses published by Synthient in perimeter and DNS security controls
  • Segment IoT and smart devices (including employee-owned Android TV boxes) away from corporate network resources and sensitive systems
  • Enforce policy requiring remote workers to access corporate resources only through managed, company-issued devices—not personal consumer electronics
  • Monitor for residential proxy traffic patterns: unusual outbound connections, bandwidth spikes, or traffic originating from home networks that mimics multiple geolocations

---

# Threat Actor Context

Actor Profile

Videostrong is a Shenzhen, China-based device manufacturer that produces Android TV boxes and other consumer electronics under its own brand and for third parties. Google attributes with high confidence that Videostrong intentionally embedded the x.cpe backdoor into device firmware across multiple models and brands over several years, then sold criminal access to the resulting botnet. The operation was not assessed to be the work of a rogue insider or accidental vulnerability. Videostrong's operators used the backdoor for ad fraud and residential proxy services, monetizing compromised home internet connections. The company has been permanently banned by Google from building or selling certified Android devices.

TTPs (Tactics, Techniques, Procedures)

The x.cpe backdoor operates as a system-level app within device firmware, communicating with C2 infrastructure to receive commands. Key capabilities include: silent app installation after disabling Google Play Protect (defense evasion); remote command execution and reverse shell access (execution); screen capture and keystroke logging (collection); exfiltration of account credentials, device information, app lists, and system logs (exfiltration); network mapping (discovery); and deployment of secondary modules for residential proxy operation and ad fraud (impact). The backdoor persists through reboots by reinstalling itself, as it is signed with the manufacturer's key and embedded in firmware. Operators deployed over a dozen malware families through the backdoor infrastructure.

Targets & Patterns

Primary targets are consumers who purchased Android TV set-top boxes, particularly MECOOL-branded devices manufactured or supplied by Videostrong. Over 1.3 million devices across 206 models were compromised, spanning TV boxes, telehealth devices, karaoke machines, and digital signage. Geographic distribution shows concentration in Malaysia, Brazil, Iraq, Mexico, and Taiwan, with 26,000-42,000 devices each in the U.S., Germany, U.K., Australia, and Canada. The targeting pattern reflects supply chain compromise rather than selective victim profiling—any purchaser of affected hardware became part of the botnet. Secondary impact extends to Internet Service Providers whose infrastructure was abused, advertising networks subjected to fraud, and organizations whose remote workers use compromised devices on home networks.

Historical Context

This operation represents a multi-year supply chain compromise spanning numerous device models and brands supplied by Videostrong. TrendAI observed 1,472,554 infected devices between June 3 and October 1, 2026, indicating sustained operations prior to the late October takedown. The backdoor infrastructure controlled not only the x.cpe implant but also more than a dozen additional malware families, suggesting an established criminal ecosystem. Google's takedown is expected to disrupt access to at least 10 million additional infected devices beyond the 1.3 million Android TV boxes, as the criminals distributed their secondary malware through multiple infection vectors. Google warns that backdoor operators and their criminal customers historically pivot quickly to new infrastructure when disrupted.

Defensive Recommendations

  • Identify and quarantine devices from the 182 published model names (particularly MECOOL-branded boxes) using network discovery tools and Synthient's published indicators of compromise
  • Block C2 domains and IP addresses associated with the x.cpe backdoor at network perimeter and DNS filtering layers
  • Segment IoT and consumer smart devices onto isolated VLANs separated from corporate or sensitive systems to limit lateral movement risk
  • Monitor for Google Play Protect being disabled on Android devices, as this is a key defense evasion indicator used by the backdoor
  • Implement zero-trust policies requiring corporate access only through managed devices, treating unmanaged consumer electronics on remote worker home networks as untrusted attack surface
  • For confirmed infected devices, perform factory reset to remove secondary modules, but recognize that x.cpe firmware-level backdoor will persist—device replacement is the only complete remediation