Thought Leadership
According to Google, device manufacturer Videostrong sold criminals access to a backdoor embedded in Android boxes. Tens of thousands of devices in Germany are infected.
Google disconnected a botnet of more than 1.3 million Android devices, primarily TV set-top boxes, from its command-and-control servers in late October. Google believes the Shenzhen-based device manufacturer Videostrong very likely embedded the backdoor, known as x.cpe, in its firmware deliberately and sold access to cybercriminals. The company considers it unlikely that the backdoor resulted from the actions of a single employee or an accidental coding error. Videostrong manufactures Android TV boxes under its own brand and for other companies. Reports do not indicate whether the company has responded to the allegations.
Through legal action, Google secured the shutdown of the botnet’s domains and servers, as well as the command-and-control domains of more than a dozen malware families downloaded through the backdoor. The operation involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, among others. Since the criminals also distribute their malware through other channels, Google expects the operation to cut off their access to at least 10 million additional compromised devices.
Advertising Fraud and Residential Proxies
The backdoor runs as a system application embedded in the firmware. Before software can be installed without the user’s knowledge, it disables Google Play Protect’s app verification checks. The backdoor can install apps, execute commands, take screenshots and scan local networks.
Most of the downloaded modules turned the boxes into so-called residential proxies. These allow customers to route their internet traffic through private internet connections. Other modules generated fraudulent advertising impressions. Beyond TV boxes, researchers also discovered the backdoor on telemedicine devices, karaoke machines and digital signage systems.
Between June 3 and October 1, TrendAI counted 1,472,554 infected devices across 206 models. Malaysia, Brazil, Iraq, Mexico and Taiwan were the hardest-hit countries. The United States, Germany, the United Kingdom, Australia and Canada each had approximately 26,000 to 42,000 infected devices.
Removing the Backdoor Is Nearly Impossible
Because x.cpe is embedded in the firmware, the backdoor reinstalls itself every time a device reboots. According to TrendAI, removing it requires action by the manufacturer, protection at the platform level or replacing the device altogether.
Synthient advises consumers to dispose of affected boxes and has published a list of 182 model names, primarily from the MECOOL brand. However, a model name alone does not confirm that a device is infected. Businesses should consider unmanaged devices on employees’ home networks part of their overall attack surface.
Google has barred Videostrong and any future subsidiaries from manufacturing certified Android devices or supplying software to other manufacturers. According to Google, the company concealed its code and only loaded it after a device’s initial startup to bypass a gap in Google’s testing procedures. Google has since updated its verification processes.
Unlike the BadBox 2.0 botnet discovered in 2025, this operation also affected certified devices.
(Editorial Team)
