Google Helps Dismantle XCPE Botnet Built by Chinese Firm

Google has disclosed that it helped dismantle the XCPE botnet, which it assessed with high confidence to have been built by Videostrong Technology, a Chinese Android ODM/OEM. The operation reportedly involved more than 1.3 million set-top boxes and extended to other devices such as telehealth gear, karaoke machines and digital signage.

Google’s Threat Intelligence Group states that Videostrong monetised the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices, enabling ad‑fraud, enrolment in residential proxy networks and further malware loading onto XCPE-compromised devices.

The action disrupted XCPE command-and-control servers used by Videostrong affiliates to deploy more than a dozen malware families, and Google claims it severed control of over 10 million compromised devices from the bot-herders. Google also says it has cut ties with Videostrong and banned them from making devices with preloaded Google apps.

Under the XCPE framework, the backdoor, known as x[.]cpe, operated with android.uid.system privileges and would automatically reinstall itself from the /oem/ partition on reboot if a user attempted removal. On startup the backdoor contacted a C2 server and used an MQTT broker to receive commands, allowing affiliates to remotely execute shell scripts, disable Google Play Protect, and silently install additional apps.

The backdoor was embedded across multiple device models over several years, with a persistent, evolving configuration designed to evade detection and manage affiliates. Google notes that the broader illicit market remains resilient and stresses accountability across the hardware supply chain, the residential proxy sector and the wider technology ecosystem.