[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fakwJb4g_a7F0th9l69YdMYH1T_tjpcPd1FFe-7vqI1w":3},{"article":4,"iocs":51,"watch_terms":63,"solutions":64,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"d8e88a7d-c20e-4232-b40b-5d17ae77e618","Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers","inside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers-89baec","Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the malware operation is the striking part: […]","Google has dismantled the XCPE botnet, which compromised over 1.3 million Android TV set-top boxes. The malware, allegedly created by Android device maker Videostrong, was used for ad fraud and to turn devices into residential proxy servers. Google has cut ties with Videostrong and is improving its firmware review process.","Google dismantled XCPE botnet using 1.3M Android TV boxes for ad fraud and proxy abuse.","https:\u002F\u002Fsecurityaffairs.com\u002F202323\u002Fmalware\u002Finside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-5.png","2026-11-03T09:52:37+00:00","2026-11-03T11:00:24.871514+00:00",8,[17,20,23,26],{"name":18,"type":19},"Videostrong","vendor",{"name":21,"type":22},"Android TV boxes","product",{"name":24,"type":25},"XCPE","threat_actor",{"name":27,"type":19},"Google","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,54,57,60],{"type":32,"value":24,"context":53},"Name of the backdoor and botnet",{"type":32,"value":55,"context":56},"x.cpe","Primary backdoor name",{"type":32,"value":58,"context":59},"com.oemservice","Alternative name for the primary backdoor",{"type":32,"value":61,"context":62},"com.abc.nexus","Name of the loader component",[27,18,21],{"controls":65,"vendors":144},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":96,"name":97,"problem":98,"products":99},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":118,"url":121,"description":122},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[128,136],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[145],{"slug":146,"name":27,"logo_path":147,"roles":148},"google","\u002Fvendor-logos\u002Fgoogle.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"13m-android-tv-boxes-hijacked-via-malware-embedded-by-device-manufacturer","1.3M Android TV Boxes Hijacked via Malware Embedded by Device Manufacturer","The XCPE botnet reveals a deeply dangerous form of supply chain compromise: malware embedded directly into firmware by the device manufacturer itself, Videostrong, before the devices ever reached consumers. This means end users had no reasonable opportunity to detect or prevent infection, as the threat originated from a trusted hardware supplier. The malware silently converted devices into residential proxy servers and ad fraud tools, exploiting the implicit trust organizations and consumers place in OEM firmware. This matters because IoT and set-top box ecosystems often lack robust firmware validation, creating a silent attack surface at massive scale. Google's delayed discovery of the firmware-level compromise underscores how insufficient supply chain vetting can enable threats to persist across millions of devices globally.",[155,156,157,158,159,160,161],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1195: Supply Chain Compromise","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"CIS Control 15: Service Provider Management":165,"MITRE ATT&CK T1195: Supply Chain Compromise":166,"CIS Control 13: Network Monitoring and Defense":167,"OWASP A06:2021 Vulnerable and Outdated Components":168,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":169},"NIS2 requires covered entities to implement supply chain security measures including assessment of supplier security practices; mandating such reviews of hardware OEMs like Videostrong would have surfaced the deliberate malware inclusion before widespread distribution.","Formal flaw remediation processes applied to firmware — including verification that OEM-supplied code is free of malicious modifications — would have mandated review cycles that could have surfaced the embedded malware before mass deployment.","Videostrong, as a hardware supplier and OEM, should have been subject to rigorous third-party vetting; this control requires organizations to assess and monitor the security practices of service and product providers to prevent exactly this kind of embedded supply chain threat.","The XCPE botnet is a textbook example of T1195, where an adversary (in this case, the manufacturer itself) implants malicious functionality into hardware or firmware prior to customer delivery, bypassing all endpoint defenses.","Continuous monitoring of network traffic originating from IoT devices would have detected the anomalous proxy-relay and ad fraud traffic patterns generated by XCPE-infected set-top boxes, enabling earlier discovery and containment of the botnet.","Firmware that ships with pre-installed malware represents a compromised component in the software supply chain; OWASP A06 highlights the risk of using components from untrusted or insufficiently vetted sources, directly applicable to OEM firmware review failures.","This control requires organizations to identify and address technical vulnerabilities in a timely manner, which extends to firmware-level threats; a structured vulnerability management process covering IoT firmware would have flagged the malicious Videostrong code."]