Affected Systems

Over 1.3 million Android TV set-top boxes manufactured by Videostrong Technology Co. (China), with additional impact on 10+ million IoT devices including MECOOL boxes by Skyworth Technology, healthcare devices, karaoke machines, and digital signage. Malware (XCPE botnet) pre-installed at manufacturing level, not a post-deployment vulnerability.

Exploitation Status

Active exploitation confirmed. Google and partners completed takedown of command-and-control infrastructure. Devices were pre-infected by manufacturer Videostrong, which monetized backdoor access by selling to criminal affiliates. Residential proxy services (AppSalt/Honeygain, NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, GaGaNode, Grass) actively used infected devices for proxy networks and advertising fraud.

Business Impact

Compromised devices secretly rent user bandwidth to residential proxy services, enabling account takeover attacks, advertising fraud, and mass content scraping. Devices may be used as DDoS attack vectors (see related Kimwolf botnet). Supply chain compromise at manufacturing level bypasses traditional security controls. Affected organizations include healthcare providers using Android-based telehealth devices. No CVE assigned as this is a deliberate supply chain attack, not a software vulnerability. Legal action taken by Google against Videostrong; domains and C2 servers seized.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Inventory all Android TV boxes and Android-based IoT devices (especially brands: Videostrong, MECOOL/Skyworth, Superbox) and isolate from network pending verification
  • Monitor network traffic for connections to residential proxy services (AppSalt/Honeygain, NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, GaGaNode, Grass) and block associated domains/IPs
  • Review firewall logs for unusual outbound proxy traffic patterns or bandwidth consumption spikes from IoT devices, particularly Android-based healthcare equipment and digital signage
  • Establish vendor security requirements for all IoT procurement that include third-party security testing and supply chain attestation, especially for Android-based devices
  • Replace affected Android TV boxes and IoT devices from implicated manufacturers with products from verified vendors that pass Google Android compatibility testing