[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:xcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"xcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor","rapid-alert","XCPE botnet: 1.3M Android TV boxes shipped with a backdoor, Google and police disrupt it","Google, Japan's NPA and partners disrupted XCPE, a backdoor that OEM Videostrong allegedly built into Android TV box firmware, enrolling more than 1.3 million devices. Removing the app does not help: it reinstalls from a protected partition on reboot.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fxcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor-305686fc-cover.png","XCPE botnet rapid alert: Bought a cheap Android TV box? The backdoor shipped inside it.","Marcus Lenngren","2026-11-03T04:18:31.219+00:00","![XCPE botnet rapid alert: Bought a cheap Android TV box? The backdoor shipped inside it.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fxcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor-305686fc-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nGoogle's Threat Intelligence Group, Japan's National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI have disrupted XCPE, a backdoor built into the firmware of Android TV set-top boxes. Google attributes the operation with high confidence to Chinese OEM and ODM Videostrong Technology Co.\n\nMore than 1.3 million set-top boxes across more than 200 countries were enrolled. Google says Videostrong deliberately preloaded the backdoor and sold access to criminal affiliates, who pushed their own modules onto the boxes.\n\nThe backdoor runs at the android.uid.system privilege level and is preloaded in the firmware partition as x.cpe, running as com.oemservice in some builds. It uses a modular, three-stage design: the primary backdoor handles C2 communications, a loader (com.abc.nexus) runs modules, and monetisation modules from affiliates do the work. Those modules turned devices into residential proxy exit nodes (Linkfog, AppSalt\u002FHoneygain, GaGaNode, NetNut, Traffmonetizer), ran ad fraud (CBOXTV, HiddenView) or installed further backdoors (Moyu, Spirit, Bird).\n\nInfected devices first make HTTP POST requests to fetch config, then open a persistent MQTT connection to receive commands. The malware contacts anyevonline[.]com for connection details and credentials, then connects to an MQTT broker hosted at mqtt.szbboys[.]com. Operators could silently install apps, disable Google Play Protect, run shell commands with system privileges, take screenshots, inject keystrokes, collect account and device data, and open reverse shells.\n\nTaking down the affiliate C2 domains is assessed to sever access to at least 10 million additional compromised devices, which arrived through other channels and include retail set-top boxes, karaoke machines, telehealth hardware and digital signage. Not all are Android devices.\n\n## Timeline\n\n- Late 2024: Videostrong moves from single-stage droppers to a modular architecture.\n- 3 June to 1 October 2026: TrendAI documents more than 3.8 million distinct home and mobile IP addresses tied to the operation.\n- August 2026: Operators begin replacing com.abc.nexus with smaller droppers disguised as system apps that use a privilege escalation exploit to write to the system partition.\n- Week of 26 October 2026: The coalition takes down the C2 domains and servers.\n- 2 November 2026: Google discloses the disruption and bans Videostrong.\n\n## Am I affected?\n\nThis is a consumer and IoT problem that lands on enterprise and home networks. You are at risk if:\n\n- You or your users run cheap Android TV boxes, projectors or Android-based IoT. Synthient found the backdoor preinstalled on a MECOOL KM9PRO Max box bought in late 2025.\n- You see outbound traffic to anyevonline[.]com or szbboys[.]com, or MQTT connections to mqtt.szbboys[.]com or mqtt.anyevonline[.]com.\n- Devices show packages named x.cpe, com.oemservice or com.abc.nexus.\n\nRemember the backdoor is in firmware, not an app a user installed.\n\n## What to do now\n\n1. Block and alert on DNS lookups to anyevonline[.]com and szbboys[.]com and their subdomains at your resolver.\n2. Block outbound MQTT (typically 1883 and 8883) from untrusted IoT and TV devices.\n3. Put consumer streaming boxes and Android IoT on an isolated VLAN with no access to internal systems.\n4. Identify affected boxes. For an infected device, either reflash with clean, trusted firmware or disconnect it from the internet. Deleting the app does not work.\n5. Treat any data that passed through an infected box as exposed: account details, system logs and anything on that network segment.\n\n## How to hunt\n\n- Search DNS and proxy logs for anyevonline[.]com, szbboys[.]com and file.anyevonline[.]com.\n- Look for persistent MQTT sessions from TV boxes and IoT to external brokers.\n- Flag devices whose Google Play Protect is disabled without user action.\n- Inventory Android-based devices and check for com.oemservice, x.cpe and com.abc.nexus.\n\n## What does not help\n\n- Uninstalling the app or doing a factory reset will not remove the infection. The primary backdoor reinstalls from the \u002Foem\u002F partition on reboot.\n- Relying on Google Play Protect will not help: the malware rewrites the setting that verifies packages and switches it off.\n\n## Sources\n\n- [Cops bust botnet of 1.3M infected Android TV boxes](https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F11\u002F02\u002Fcops-bust-botnet-of-13m-infected-android-tv-boxes\u002F5307045), The Register Security, 2 Nov\n- [Shutting the Door on the XCPE Botnet](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fshutting-the-door-on-the-xcpe-botnet\u002F), Google Threat Intelligence, 2 Nov\n- [Google disrupts million-device XCPE Android malware botnet, bans TV box maker](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgoogle-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker\u002F), BleepingComputer, 2 Nov\n- [Google disrupts XCPE botnet, bans the company behind it](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F02\u002Fxcpe-botnet-android-backdoor\u002F), Help Net Security, 2 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"artex-ai-autonomous-agents-run-active-directory-attacks-at","ARTEX AI: autonomous agents run Active Directory attacks at machine speed against 200+ orgs","Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-cover.png","ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes","2026-11-03T04:23:57.557+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"coruna-and-darksword-zero-click-iphone-spyware-steals-data","Coruna and DarkSword: zero-click iPhone spyware steals data from a single web page visit","Two iPhone exploit kits, Coruna and DarkSword, infect phones from a single web page with no app and no prompt. Zimperium found 608 delivery domains. Apple has notified targeted users in 99 countries. Every CVE is already patched.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcoruna-and-darksword-zero-click-iphone-spyware-steals-data-9c36ddb3-cover.png","Coruna\u002FDarkSword rapid alert: Your iPhone on iOS 17 or 18? One web page visit and it is theirs.","2026-11-01T05:36:03.059+00:00",{"slug":44,"kind":45,"title":46,"excerpt":47,"cover_image_url":48,"cover_image_alt":49,"author_name":11,"published_at":50,"reading_minutes":51},"package-security-without-starting-on-the-laptop","analysis","Package security in three steps, and why you do not have to start on the laptop","AI coding agents now pick and install packages on engineering machines in seconds, and few teams can say what was pulled in. A threat feed you can search this week, a registry firewall that fits the network you already run, and the endpoint last. Notes from a session with Socket.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1cc0747e-9558-4214-a9a4-10cae453ca38.png","A digital shield protects a data stream from threats, representing layered package security.","2026-10-31T07:07:36.208+00:00",4]