XCPE Backdoor Turns Android TV Boxes Into Residential Proxy Nodes

EXECUTIVE SUMMARY:

The XCPE backdoor was distributed through pre-installed firmware on Android-based set-top boxes and other internet-of-things devices manufactured by Videostrong Technology. This Android original equipment manufacturer embedded the malicious software directly into the system partition of multiple device models over several years. The initial access vector is known, as the code is part of the device's base image rather than a separate download. The scope includes over 1.3 million enrolled devices globally, with concentrations in specific regions. The risk to users is severe, as their hardware was silently converted into a distribution mechanism for criminal actors without consent, facilitating ad fraud, data theft, and malicious traffic routing.

The malware operates through a modular, three-stage architecture designed for resilience and multi-tenant monetization. The primary backdoor runs at system privilege levels and persists by automatically reinstalling itself from the firmware partition if removed. It communicates with command and control servers using a two-stage protocol, initially fetching configuration via encrypted HTTP requests before establishing a persistent message queuing telemetry transport connection. This channel allows operators to issue commands for silent application installation, arbitrary shell execution, screen capture, and network reconnaissance. A separate loader package handles the execution of monetization modules, which are deployed as native daemons, embedded software development kits, or secondary applications. These modules transform devices into residential proxy exit nodes for various bandwidth-sharing services, ad-fraud engines, or additional backdoors. The system employs anti-analysis utilities to filter system calls and prevent sandbox detection, while newer variants use disguised system applications to install payloads into protected partitions and grant themselves elevated permissions.[emaillocker id="1283"]

The campaign was driven by financial gain, with the manufacturer selling access to criminal affiliates who loaded their own malware modules onto the compromised infrastructure. The botnet is globally dispersed, affecting not only set-top boxes but also telehealth devices, karaoke machines, and digital signage units. The operators actively evolved the malware to evade detection, recently deploying new dropper packages that bypass standard security checks. Disrupting the command and control infrastructure severs access to millions of additional devices, but the interconnected nature of the supply chain requires continued targeting. Defensive implications include the need for stricter firmware integrity reviews and monitoring for unauthorized system-level modifications in consumer electronics.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://cybersecuritynews.com/google-dismantles-xcpe-botnet/
• https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet