Google disrupts XCPE botnet that hijacked 1.3 million devices

Google and partners dismantled a backdoor campaign dubbed XCPE that enrolled more than 1.3 million set‑top boxes into a botnet used for ad fraud and proxy abuse, Security Affairs reports. The backdoor, preloaded in firmware as x[.]cpe (com[.]oemservice in some builds), was allegedly created and run by Videostrong Technology Co., an Android device maker, which Google says operated the botnet for financial gain and sold access to criminal groups.

Infected devices were used to form residential proxy networks, hide criminal activity, and load further malware modules, with operation spanning several device models and brands over multiple years.

Investigators describe a well‑structured scheme: the backdoor communicates with a control server, then passes work to a loader named com.abc.nexus that includes anti‑analysis tricks and delivers monetisation modules supplied by affiliates. Modules can be installed as part of the backdoor, added to the loader, or downloaded later, enabling tasks such as turning devices into proxy endpoints, conducting ad fraud, or installing additional backdoors.

Communications rely on MQTT to receive commands, after an initial HTTP fetch for settings and network data. In practice, operators used GitHub releases hosted on their accounts, Filemail shares, and other operator‑controlled servers, with a notable reliance on an EMQX web console for command management.

Google, alongside Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, also pursued takedowns of domains and servers used to control the botnet and the associated malware families. Google notes that consumer devices—including Android TV set‑top boxes, telehealth devices, karaoke machines and digital signage—were affected, and warns that even devices with opt‑in mechanisms could be co‑opted if not properly secured.