Search — “anyevonline.com”

GTIG assesses with high confidence that Android OEM/ODM Videostrong preloaded the x.cpe (com.oemservice) system-privileged backdoor on Android TV set-top boxes and other IoT devices, selling access to affiliates who loaded residential proxy, ad-fraud and further backdoor modules. The backdoor bootstraps over HTTP POST to *.anyevonline.com:8000, then uses MQTT (mqtt.szbboys.com, ports 3885-3887) for silent installs, shell commands, screenshots and recon; newer droppers use libexploit.so to root adbd and copy themselves into /system/priv-app. Google and partners disrupted the C2 infrastructure. Hunters should look for network traffic to the listed domains/IPs and MQTT on 3885-3887 from Android TV/IoT devices on corporate or guest networks, and residential proxy egress.