Google action disrupts Android TV botnet tied to Videostrong

Google says it disrupted the command-and-control infrastructure of an Android botnet linked to more than 1.3 million devices, predominantly TV set-top boxes. The operation in late October targeted domains and servers used to control devices carrying a firmware backdoor called x.cpe.

Google said it was highly confident that Shenzhen-based device maker Videostrong intentionally embedded the backdoor and sold access to criminals. The company has barred Videostrong, as well as future subsidiaries and affiliates, from building or selling certified Android devices and from supplying software to other certified device manufacturers.

A backdoor embedded in device firmware

The x.cpe component runs as a system application in firmware with system-level access. It contacts command-and-control servers for instructions and, before silently installing software, can disable application checks in Google Play Protect.

Google reported that operators used the backdoor to execute commands, capture screens and map the networks where the devices were connected. Its analysis also documented live screenshots, keystroke injection, collection of account information, device data, application lists and system logs, and reverse shells that provide remote command-line access.

Most add-on modules used the compromised boxes as residential proxies or monetised their bandwidth. Other modules generated fraudulent online-ad views. Although TV boxes made up most infections, the backdoor was also found on telehealth equipment, karaoke machines and digital-signage devices.

Scale, affected models and remediation limits

TrendAI, Trend Micro's enterprise business unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1, stating that the actual total is at least that high. Malaysia, Brazil, Iraq, Mexico and Taiwan recorded the largest concentrations, while the United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000 devices.

Synthient published 182 model names observed in the campaign, while cautioning that a model name alone does not establish infection. Its research concentrated on MECOOL-branded boxes linked to Videostrong, including a MECOOL KM9PRO Max purchased with the backdoor already installed. Plume likewise identified more than a dozen device types using the botnet control server, most from MECOOL.

Removing x.cpe is not a straightforward cleanup task because it is part of the firmware and reinstalls when a device restarts. TrendAI said remediation requires vendor action, platform protection or replacing the device. Plume recommends a factory reset to address potentially installed secondary backdoors, while Synthient advises consumers to discard affected boxes because of the malware risk.

Certification controls and business exposure

Google said Videostrong concealed code to exploit a gap in its compatibility and security testing, loading the malicious component after a device's first boot. Google has changed its review process and is improving firmware checks for certified Android TV devices. Plume said the botnet included both Google-certified products and devices running the Android Open Source Project version, while Google did not disclose how many certified products were affected.

Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It also disabled control domains for more than a dozen malware families delivered through the backdoor, and expects the action to deny those operators access to at least 10 million additional infected devices because their malware also spread through other channels.

For organisations, the immediate task is to use published indicators to locate MECOOL and similar devices, disconnect and replace suspicious hardware, and block known control domains and IP addresses. Smart devices should be segmented away from sensitive systems, while remote-access policies should account for unmanaged consumer equipment on home networks as part of the attack surface.