# Inside XCPE: The Botnet Turning Android TV Boxes into Proxy Servers Google dismantles a massive botnet operation orchestrated by hardware manufacturer Videostrong for illicit profit. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0b79c907-d667-4c11-abd4-95d2d0d289d2 ## Systemic Firmware Backdoor Discovery Google recently dismantled the XCPE botnet, which compromised 1.3 million Android TV devices. The operation was traced back to Videostrong Technology Co., an original equipment manufacturer. Unlike typical malware, this backdoor was pre-installed directly into the device firmware, allowing it to maintain persistent system privileges across multiple product models and brands. ## Monetization Through Criminal Affiliates Videostrong deliberately operated this botnet to generate recurring revenue by selling access to criminal groups. These affiliates deployed various malicious modules, including ad-fraud tools and residential proxy software. By turning consumer hardware into proxy servers, the attackers monetized victim bandwidth while simultaneously stealing sensitive account information and system logs from devices. ## Sophisticated Evasion and Persistence The malware utilized code obfuscation to bypass Google’s compatibility and security testing protocols. It remained dormant until the first boot, effectively hiding from initial checks. If a user attempted to uninstall the malicious service, the backdoor automatically reinstalled itself from the protected system partition during the next reboot cycle, ensuring long-term control. ## Command and Control Infrastructure The botnet relied on a centralized MQTT messaging protocol to receive instructions from operators. Devices communicated with a specific server to download configuration settings and additional malicious payloads. Attackers managed this infrastructure via remote interfaces and web consoles, often hosting malicious files on GitHub releases to maintain a low-profile, persistent command chain. ## Broad Impact Beyond Streaming Boxes While Android TV boxes were the primary targets, the infection extended to telehealth devices, karaoke machines, and digital signage. A single device could simultaneously run multiple residential proxy kits, such as Linkfog or AppSalt. This aggressive resource utilization demonstrates a clear intent to maximize financial extraction from every compromised hardware unit. ## Severe Regulatory and Business Consequences Google has severed all business ties with Videostrong, banning the company from pre-installing Google apps on future devices. This prohibition extends to all subsidiaries and business partners, effectively cutting the manufacturer out of the certified Android ecosystem. Google also initiated legal action against the control domains used to manage the botnet infrastructure. ## Industry-Wide Security Accountability The investigation highlights a resilient supply chain where malware operators quickly switch between loaders and rival kits when disrupted. Google now urges retailers and distributors to mandate independent security audits for all hardware manufacturers. They emphasize that transparency in user consent is critical, especially regarding residential proxy providers that often operate unethically. ## Consumer Protection and Future Outlook Users are advised to avoid apps promising payment for sharing unused bandwidth, as these are primary vectors for proxy network growth. Maintaining Google Play Protect and purchasing devices from reputable, verified manufacturers remains the best defense. Lasting security requires collective intelligence sharing among ISPs, mobile platforms, and marketplaces to close this vector. ## Sources covering this story - https://securityaffairs.com/202323/malware/inside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._