Executive Summary
Google and industry partners have disrupted the XCPE botnet, a large-scale supply-chain infection affecting over 1.3 million Android-based set-top boxes and IoT devices. Analysis confirms with high confidence that Videostrong Technology Co., an Android OEM/ODM, intentionally preloaded the malware into device firmware. The botnet served as a distribution platform, allowing Videostrong to monetize infected devices by selling access to criminal affiliates who deployed modules for ad-fraud, residential proxy networking, and data exfiltration.
The attack chain involves a persistent system-level backdoor (x.cpe) that utilizes a modular architecture to evade detection. Initially acting as a stub in the firmware, it downloads secondary loaders like 'com.abc.nexus' to execute various monetization modules. The operators utilized a sophisticated C2 infrastructure involving both HTTP for bootstrapping and MQTT for real-time command execution, including silent application installation and screen capturing.
This campaign represents a significant breach of trust in the hardware supply chain. By embedding malware at the manufacturing stage, the actors ensured persistence that survives factory resets. While C2 domains have been disrupted, the resilience of the interconnected proxy and ad-fraud ecosystem necessitates ongoing monitoring of the identified malware families and infrastructure artifacts.