Search — “X.CPE”

Google, Japanese law enforcement, and security firms TrendAI, Human and Synthient disrupted domains underpinning the X.CPE botnet, which was built into firmware of more than 1.3 million Android TV set-top boxes and other Android IoT devices. Google attributes the scheme to Videostrong Technology, which allegedly sold backdoor access to criminal affiliates who loaded malware modules onto infected devices for residential proxy, ad fraud, and other monetization. The sources do not describe specific process-level host telemetry or detection queries; hunters should focus on unexpected residential proxy traffic and unexplained outbound connections from Android TV, set-top, and IoT devices on the network.

GTIG assesses with high confidence that Android OEM/ODM Videostrong preloaded the x.cpe (com.oemservice) system-privileged backdoor on Android TV set-top boxes and other IoT devices, selling access to affiliates who loaded residential proxy, ad-fraud and further backdoor modules. The backdoor bootstraps over HTTP POST to *.anyevonline.com:8000, then uses MQTT (mqtt.szbboys.com, ports 3885-3887) for silent installs, shell commands, screenshots and recon; newer droppers use libexploit.so to root adbd and copy themselves into /system/priv-app. Google and partners disrupted the C2 infrastructure. Hunters should look for network traffic to the listed domains/IPs and MQTT on 3885-3887 from Android TV/IoT devices on corporate or guest networks, and residential proxy egress.