Google and police dismantle Videostrong Android TV botnet

Google and international law enforcement have dismantled the Videostrong XCPE botnet, which enrolled more than 1.3 million Android TV devices, telehealth monitors, karaoke consoles and digital signs into a covert command-and-control network. Investigators say the backdoor was pre-installed by Videostrong Technology inside factory firmware, in the /oem/ system partition, so it could survive factory resets and reappear after reboots.

The operation also extended to affiliates’ hardware, with access to more than 10 million additional compromised devices severed by taking down associated command servers. Google researchers described the compromise as a deliberate act by the device manufacturer, not a flaw exploited after sale, and Google subsequently cut business ties with Videostrong and revoked its Android TV certification.

The infection chain involves a factory-installed package named x[.]cpe or com[.]oemservice. Once present in firmware, the code runs with system privileges and can reinstall itself even if users attempt removal. A two-stage loader then routes commands to a secondary package named com.[abc].nexus, which employs libseccomp_guard.so to hinder anti‑analysis tools.

The malware disables Google Play Protect scanning and downloads monetisation modules from operator-controlled repositories, with dropper packages like com.android.system.ntp capable of copying payloads into the system partition. Command and control relies on encrypted HTTP requests to anyevonline[.]com for network configurations, followed by a real-time MQTT connection to a central broker.

Operators push shell commands, silent APK downloads, synthetic keystrokes and screen captures, and extract device identifiers, inventories and logs for monetisation via residential proxies and ad-fraud engines such as HiddenView and Fission. Defenders are advised to monitor for unauthorised MQTT traffic and lookups to szbboys[.]com and anyevonline[.]com, and to isolate IoT devices on dedicated networks.