Shutting the Door on the XCPE Botnet

What it is

XCPE is a firmware-level Android backdoor, shipped as package x.cpe (or com.oemservice in some builds) on devices from Videostrong Technology. Google Threat Intelligence Group says it enrolled more than 1.3 million set-top boxes. Most are Android TV boxes, but it also found telehealth devices, karaoke machines and digital signage. Google also estimates that taking down the affiliates' C2 domains cuts access to at least 10 million more compromised devices. Those affiliates distribute their modules through other channels as well.

How it works

The stub runs as android.uid.system from the firmware partition. On boot it installs the full package from /oem/ into /data/app/. If a user uninstalls it, it reinstalls on the next reboot.

For C2 it first sends an AES-encrypted HTTP POST (serial number, MAC, model, firmware version) to a bootstrap host. The host is mcstb.anyevonline.com:8000 when ro.mecool.device is true. Otherwise it is stb[AndroidVersion][Type].anyevonline.com:8000. The endpoints are /router/config/mqtt, /router/config/acs and /router/config/app. It then holds a persistent MQTT connection for tasking. The commands include silent APK install, arbitrary shell as system UID, screen capture with key injection, and traceroute and WHOIS recon. Operators were also seen exfiltrating account and package data and opening reverse shells.

Play Protect is disabled by setting package_verifier_user_consent to -1 through Settings.Global.

Modules are not in x.cpe. Since late 2024 a loader, com.abc.nexus, runs them. It uses libseccomp_guard.so to block thread pausing, cross-process interference and child processes. Modules include residential proxy SDKs (Linkfog, Jaguar, AppSalt/Honeygain, BWM/IPWeb, GaGaNode, NetNut/Popanet, Traffmonetizer, EarnFM), further backdoors (Spirit, Moyu, Bird) and ad fraud (Fission, HiddenView). One device can run up to three proxy SDKs. AppSalt exits if the app was installed from Google Play.

The page says that since August 2026 the operators have pushed new droppers over MQTT while mass-uninstalling com.abc.nexus. These droppers are disguised as com.android.system.ntp and com.android.sso.auth.handler. They extract libexploit.so, which calls nativeAdbRoot() and nativeAdbShell(). They then remount /system read-write and copy themselves to /system/priv-app/. They also write /system/etc/permissions/privapp-permissions-<app name>.xml, granting INSTALL_PACKAGES and REBOOT. Operators control them through these properties:

persist.networkstack.uninstall
persist.networkstack.skip_system_install
persist.networkstack.install_time

The last one backdates the app's timestamp to match other system packages.

What to do

Indicators from the page that can be hunted for:

• Hostnames: mqtt.szbboys[.]com, ott.szbboys[.]com, *.anyevonline[.]com (earlier builds used *tms, *ott and *ota under szbboys[.]com).
• Broker IPs 219.134.163[.]210 and .211, on TCP ports 3885-3887.
• Operator-controlled file hosts 38.145.197[.]135 and 23.94.49[.]57, plus filemail[.]com and GitHub release pages (the sample module URL was under github.com/Aviciiii/ott).
• On-device artifacts:
• Packages: x.cpe, com.oemservice, com.abc.nexus, com.ota.service.
• Content provider authorities: com.release.debug.provider and com.oem.share.provider.
• Files and settings: libseccomp_guard.so, libexploit.so, and package_verifier_user_consent set to -1.
• Unexpected /system/priv-app/ entries and privapp-permissions-*.xml files.
• persist.networkstack.* properties.

Google recommends that retailers and distributors require independent security audits from ODMs and delist implicated manufacturers. It tells consumers to buy set-top boxes only from reputable makers, check its Android TV partner list, avoid "share your bandwidth" apps, and keep Play Protect on. Google has also banned Videostrong and its future subsidiaries and affiliates from certified Android devices. It changed its review of certified Android TV firmware, because Videostrong loaded the malicious code after first boot to pass compatibility tests.

Caveats

• Removing x.cpe from /data/app/ does not work, because it returns on reboot from /oem/. The page offers no removal procedure, so affected firmware likely needs replacing.
• Google says the takedown is a point-in-time disruption. Operators pivot quickly to new loaders or rival SDKs, so these indicators may age fast.
• The page attributes the operation to Videostrong with high confidence. That is Google's assessment, not a court finding.
• The page gives no list of affected brands or models, and no SHA-256 hashes. It gives only a few MD5 values, in sample config payloads.