Ethical Hacking News
A recent takedown by tech firms, in collaboration with Google, has dismantled the XCPE botnet, a complex web of malicious intent and exploitation that had compromised over 1.3 million Android TV set-top boxes. The botnet, developed by Videostrong Technology Co., had been secretly renting the user's internet connection out to strangers and conducting advertising fraud. This widespread nature of the botnet highlights the need for a unified approach to addressing the growing threat of IoT-based attacks. The takedown has severed ties with over 1.3 million devices, with estimates suggesting that the botnet may have had access to at least 10 million additional compromised devices.
The XCPE botnet was comprised of over 1.3 million Android TV set-top boxes infected with malicious software. The malware rented user's internet connection out to strangers and conducted advertising fraud. Videostrong Technology Co., the Chinese TV box manufacturer, developed the malicious software that infected the devices. The botnet also infected other Android-based IoT products, including telehealth devices, karaoke machines, and digital signage systems. Residential proxy providers, such as AppSalt and NetNut, played a role in the spread of the XCPE botnet. The botnet's distribution channels included multiple proxy services, including Jaguar, LINKFOG, and BMW/IPWeb. Synthient's research helped to fragment the XCPE botnet, making it easier for network operators to manage. The XCPE botnet's takedown severed ties with over 1.3 million devices, but estimates suggest that the botnet may have had access to at least 10 million additional compromised devices.
The tech world has witnessed numerous botnets in the past, each with its unique characteristics and malicious intent. However, the XCPE botnet, recently dismantled by tech firms in collaboration with Google, has left a trail of intrigue and complexity. According to the Google Threat Intelligence Group (GTIG), the XCPE botnet was comprised of over 1.3 million Android TV set-top boxes that had been secretly infected with malicious software. This software, developed by Videostrong Technology Co., a Chinese TV box manufacturer, allowed the malware to rent the user's internet connection out to strangers and conduct advertising fraud.
The GTIG report reveals that Videostrong had found a way to load their malicious software immediately after a user boots up one of these devices for the first time. This lack of oversight on the part of the device manufacturer is a stark reminder of the importance of passing compatibility and security tests for all Android devices. Despite this oversight, Google has since addressed the weakness.
The XCPE botnet had also infected other Android-based IoT products, including telehealth devices, karaoke machines, and even digital signage systems. This widespread nature of the botnet highlights the need for a unified approach to addressing the growing threat of IoT-based attacks.
Furthermore, the GTIG report highlights the role of residential proxy providers in the spread of the XCPE botnet. These services, such as AppSalt, also known as Honeygain, which is owned by the Vilnius, Lithuania-based Oxylabs, offer software development kits that are routinely downloaded by devices infected by the XCPE botnet. This has led to a situation where proxy providers are linked to the botnet, further complicating the issue.
In addition, the GTIG report notes that the XCPE botnet was also distributed through other proxy services, including NetNut, EarnFM, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. This diversity of proxy providers has led to a complex web of distribution channels for the malware, making it harder to track and dismantle.
Synthient, a startup that tracks proxy providers, played a significant role in the takedown of the XCPE botnet. Their research, published in January 2026, documented the rapid spread of the Kimwolf botnet, which had compromised millions of Android set-top boxes virtually overnight. Synthient's research caused dozens of residential proxy providers to patch their networks, which helped to fragment the Kimwolf botnet into much smaller pieces that made its DDoS attacks far easier for network operators to manage.
In a report published today, Synthient examined a popular, pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology. The report concluded that MECOOL also bundled the malware from Videostrong Technology Co. and installed AppSalt/Honeygain and other proxy components.
The MECOOL storefront and marketing. Image: Synthient.com.
Synthient founder Ben Brundage stated that Videostrong's malware also distributed software for the proxy service Grass. This further highlights the complexity of the XCPE botnet and the various proxy services involved.
In November 2025, a researcher from Censys found the popular Superbox TV streaming device bundled Grass's residential proxy software. This was noted in a story at the time, which also quoted the Grass founder, who denied any affiliation with the TV box maker.
The popular Youtube channel Linus Tech Tips discussing MECOOL TV streaming boxes.
The XCPE botnet's takedown has severed ties with over 1.3 million devices, with estimates suggesting that the botnet may have had access to at least 10 million additional compromised devices. The report by the GTIG notes that the various proxy and ad fraud affiliates of Videostrong have diversified distribution channels for their modules beyond XCPE.
"The scale of affected devices is likely way higher," said Ben Brundage. "This is probably the largest operation against backdoored TV boxes that we've seen."
Further reading:
Plume Security Labs white paper on the XCPE botnet (PDF)
Black Lotus Labs writeup on LinkedIn
TrendAI's analysis
Synthient's list of affected devices, broken down by model number
This entry was posted on Monday 2nd of November 2026 09:24 PM
Related Information:
https://www.ethicalhackingnews.com/articles/Unraveling-the-XCPE-Botnet-A-Complex-Web-of-Malicious-Intent-and-Exploitation-ehn.shtml
https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/
Published: Mon Nov 2 21:36:47 2026 by llama3.2 3B Q4_K_M
