Ethical Hacking News
The XCPE botnet is a complex threat that has infected over 1.3 million set-top boxes, transforming them into proxy servers without the users' knowledge or consent. The malware was preloaded in the firmware and ran with system privileges, enabling ad fraud and proxy abuse. Google has taken action against Videostrong Technology Co., the manufacturer behind the botnet, and urges retailers and consumers to take steps to prevent similar incidents in the future.
XCPE, a sophisticated botnet, has infected over 1.3 million Android TV set-top boxes, compromising security and privacy. Videostrong Technology Co., the manufacturer, built and operated the botnet for financial gain through ad fraud and proxy abuse. The malware, preloaded in firmware, communicated with a control server using MQTT protocol and passed work to a loader, which set up money-making modules. The botnet was used to create residential proxies, allow ad fraud, and install additional backdoors. Google has cut ties with Videostrong and taken legal action against the domains and servers used to control the botnet. Google urges retailers and distributors to require security audits from device manufacturers and consumers to be cautious with apps that pay for "unused bandwidth" or "sharing your internet."
Pierluigi Paganini, a renowned cybersecurity expert, has shed light on a sophisticated botnet known as XCPE, which has been identified by Google as a significant threat to the security and privacy of millions of Android TV set-top boxes worldwide. In a detailed report, Google revealed that Videostrong Technology Co., an Android device manufacturer, built and operated the botnet for financial gain, using it to enable ad fraud and proxy abuse.
The XCPE botnet is estimated to have enrolled over 1.3 million set-top boxes, transforming them into proxy servers without the users' knowledge or consent. The malware, which was preloaded in the firmware and ran with system privileges, communicated with a control server using the MQTT protocol and passed work to a loader called com.abc.nexus. The loader carried its own anti-analysis tricks and set up the money-making modules, which were supplied by other criminals working as affiliates.
These modules could arrive as programs built into the backdoor, software packages added to its loader, or extra apps downloaded later. Many turned the device into a residential proxy, allowing other people to use the victim's home internet connection to hide their online activity. Others committed ad fraud or installed additional backdoors. The configuration showed a well-run operation, with MQTT messages carrying resource limits for each module, download links per processor type, and priority weights.
Devices were assigned to one of six timezone-based pools on ott.szbboys[.]com. Devices reported their bandwidth use and alarms back, so the modules stayed within set limits. The underlying market is resilient, with backdoor operators, ad-fraud rings, and residential proxy providers working as an interconnected supply chain. When one part gets disrupted, they quickly switch to new loaders or rival kits.
Google wants retailers and distributors to require independent security audits from device manufacturers and to delist any implicated in supply-chain abuse. It also urges consumers to be cautious with apps that pay for "unused bandwidth" or "sharing your internet", which are a main way illicit proxy networks grow. The company advises sticking to app stores you trust, reviewing permissions for third-party VPNs and proxies, and keeping Google Play Protect on.
The ban also covers any future subsidiaries or business partners, and Videostrong can no longer supply software to other certified device makers. Google has cut all ties with Videostrong and taken legal action against the domains and servers used to control the botnet and against the control domains of over a dozen malware families loaded through the backdoor.
The malware has three stages, with the primary backdoor, x.cpe, handling communication with the control server and passing work to a loader called com.abc.nexus. The loader carries its own anti-analysis tricks and sets up the money-making modules. Many turn the device into a residential proxy, allowing other people to use the victim's home internet connection to hide their online activity. Others commit ad fraud or install additional backdoors.
The configuration shows a well-run operation, with MQTT messages carrying resource limits for each module, download links per processor type, and priority weights. Devices are assigned to one of six timezone-based pools on ott.szbboys[.]com. Devices report their bandwidth use and alarms back, so the modules stay within set limits.
In a statement, Google concludes that a device manufacturer intentionally infecting its users with malware is an unacceptable breach of trust. By turning everyday hardware into persistent beachheads for criminal affiliates, Videostrong prioritized illicit post-sale recurring revenue over the safety and privacy of its users. Downstream hardware brands, white-label resellers, telecommunications providers, and online e-commerce marketplaces also share responsibility for closing this vector.
The incident highlights the need for accountability across hardware makers, the residential proxy industry, and the broader technology sector. It also underscores the importance of transparency and auditable proof of user consent in the industry.
The report is a stark reminder of the complexity and sophistication of modern cyber threats. The use of IoT devices, such as set-top boxes, to enable botnets and facilitate ad fraud and proxy abuse is a growing concern. The incident serves as a warning to device manufacturers, retailers, and consumers to prioritize security and privacy above profits.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Rise-of-XCPE-A-Complex-Botnet-Built-from-Set-Top-Boxes-to-Enable-Ad-Fraud-and-Proxy-Abuse-ehn.shtml
https://securityaffairs.com/202323/malware/inside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers.html
Published: Tue Nov 3 06:17:55 2026 by llama3.2 3B Q4_K_M
