Google va sanoat hamkorlari 1,3 milliondan ortiq Android TV striming TV qutilaridan iborat XCPE zararli dastur botnetini yo'q qildi. Google aytishicha, ishlab chiqaruvchi qurilmalarni qasddan zararli dastur bilan yuqtirgan va kiberjinoyatchilik faoliyati orqali daromad olish maqsadida shunday qilgan.
Kompaniya botnetni yuqori ishonch bilan Xitoy qurilma ishlab chiqaruvchisi Videostrong Technology Co.ga bog'laydi va kompaniyani o'zi ishlab chiqargan qurilmalarga doimiy orqa eshikni qasddan o'rnatganlikda va jinoiy sheriklarga kirish huquqini sotganlikda ayblaydi.
Bu sheriklar orqa eshik o'rnatilgan qurilmalardan foydalanib, zararli modullarni joylashtirgan. Ular reklama firibgarligi uchun ishlatilgan, yuqtirilgan qurilmalarni turar-joy proksi-serverlariga aylantirgan va qo'shimcha zararli dasturlarni o'rnatgan.
Buzilish doirasida Google XCPE buyruq va nazorat (C2) serverlarini yo'q qilganini aytadi. Bu serverlar o'ndan ortiq bog'liq zararli dastur oilalari tomonidan ishlatilgan va kamida 10 million qo'shimcha buzilgan qurilmalarga kirishni to'xtatgan.
Bu qo'shimcha qurilmalar XCPE'dan boshqa yo'llar bilan tarqalgan zararli dastur orqali buzilgan va ular orasida chakana savdo set-top qutilari, karaoke mashinalari va telemeditsina apparatlari bor. Google aytishicha, ularning barchasi Android qurilmalari emas.
Google shuningdek Videostrong bilan munosabatlarini tugatgan, oldindan o'rnatilgan Google ilovalari va xizmatlari bilan Android TV qurilmalarini ishlab chiqarish litsenziyasini bekor qilgan va kompaniya hamda uning kelajakdagi sheriklarini sertifikatlangan Android qurilmalarini ishlab chiqarish yoki sertifikatlangan sotuvchilarga dasturiy ta'minot yetkazib berishdan taqiqlagan.
"Biz yuqori ishonch bilan orqa eshik va botnet Videostrong Technology Co. tomonidan moliyaviy foyda olish maqsadida qasddan ishlab chiqilgan, joylashtirilgan va boshqarilgan deb baholaymiz", — deb aytgan Google Threat Intelligence Group (GTIG) dushanba kuni chop etilgan hisobotda.
Google aytishicha, buzilish Yaponiya Milliy Politsiya Agentligi va Lumen, HUMAN Security, Plume, Synthient va TrendAI xavfsizlik kompaniyalari bilan muvofiqlashtirilgan. Ular zararli infratuzilmani tahlil qilish va uning faoliyatini buzish uchun hamkorlik qilgan.
Boshqa botnetlardan farqli o'laroq, ular odatda qurilmalarni zaifliklar orqali buzadi yoki foydalanuvchilarni zararli dastur o'rnatishga aldashadi, XCPE botneti esa ishlab chiqarish jarayonida to'g'ridan-to'g'ri qurilma proshivkasiga o'rnatilgan.
Google aytishicha, Videostrong zararli dasturini bir necha yil davomida turli qurilma brendlari va modellari bo'yicha tarqatgan, uning imkoniyatlarini aniqlashdan qochish va turli jinoiy sheriklarni qo'llab-quvvatlash uchun doimiy ravishda rivojlantirgan.
"Biz bu zararli dasturiy ta'minotni ko'plab turli qurilma modellari va brendlari ichida bir necha yil davomida topdik. U maxsus infratuzilma bilan qo'llab-quvvatlangan va aniqlashdan qochish hamda sheriklarini boshqarish uchun doimiy ravishda o'zgarib turadigan konfiguratsiyalar bilan ishlagan", — deb aytadi Google.
Asosiy orqa eshik komponenti x.cpe va com.oemservice nomlari bilan kuzatiladi va Android tizim darajasidagi huquqlar bilan ishlaydi.
Zararli dastur modulli arxitekturadan foydalanadi, bu esa orqa eshik funksiyalarini sheriklar uchun daromad olishga mo'ljallangan modullardan ajratadi.
Yuqtirilgan qurilma ishga tushgandan so'ng, XCPE anyevonline[.]com domenidagi buyruq va nazorat serveriga murojaat qiladi. U MQTT xabar brokeri uchun ulanish ma'lumotlari va hisob ma'lumotlarini oladi, keyin esa buyruqlarni qabul qilish uchun ishlatiladi.
Google aytishicha, zararli dastur Android versiyasi va qurilma turiga qarab anyevonline[.]com domenining turli subdomenlaridan foydalanadi. MQTT brokeri mqtt.szbboys[.]com manzilida joylashgan bo'lib, operatorlarga buyruqlar yuborish va yuqtirilgan qurilmalarga boshqa zararli dasturlarni joylashtirish imkonini bergan.
Bu ulanish orqali operatorlar buzilgan qurilmalarni masofadan boshqarishi va quyidagi zararli harakatlarni amalga oshirishi mumkin:
- Qo'shimcha Android ilovalarini yashirincha yuklab olish va o'rnatish.
- Google Play Protect'ni o'chirish.
- Tizim huquqlari bilan shell buyruqlari va skriptlarini bajarish.
- Ekran tasvirlarini olish va klavish bosishlarini yozib olish.
- Hisob ma'lumotlari, qurilma tafsilotlari, o'rnatilgan ilovalar ro'yxati va tizim jurnallarini yig'ish.
- Tarmoqni tekshirish va teskari shell'larni o'rnatish.
Qurilmalar shuningdek boshqa operatorlarga tegishli zararli dastur modullarini o'rnatish orqali daromad olish uchun ishlatilgan. Bu orqa eshikni boshqa kiberjinoyatchilar uchun plagin kiberjinoyatchilik platformasiga aylantirgan.
Google ma'lumotiga ko'ra, bu modullar Linkfog, AppSalt/Honeygain, GaGaNode, NetNut va Traffmonetizer kabi turar-joy proksi xizmatlari bilan bog'liq dasturiy ta'minotni o'z ichiga olgan. Ular uchinchi tomon internet trafikini qurilma egalarining bilimi yoki roziligisiz yuqtirilgan qurilmalar orqali yo'naltirish uchun ishlatilgan.
Boshqa modullar reklama firibgarligini amalga oshirgan: reklama taassurotlarini yaratish, yashirin veb-sahifalarni yuklash va reklamalarga bosish. Ba'zi modullar Moyu, Spirit va Bird kabi boshqa orqa eshiklarni o'rnatgan va boshqa zararli dasturlarni yuklab olish va bajarish uchun ishlatilgan.
Google aytishicha, botnet operatorlari aniqlashdan qochish uchun zararli dastur arxitekturasini doimiy ravishda o'zgartirgan.
2024-yil oxirida Videostrong com.abc.nexus deb nomlangan alohida yuklovchini ishlata boshlagan. U zararli modullarni ishga tushirgan, XCPE esa C2 infratuzilmasi bilan aloqani saqlab qolgan.
2026-yil avgustidan boshlab operatorlar bu yuklovchini Android tizim ilovalari sifatida niqoblangan kichikroq, maxsus droppers bilan almashtira boshlagan.
Videostrongni aniqlash
Alohida muvofiqlashtirilgan hisobotda Synthient xavfsizlik firmasi XCPE orqa eshigi va infratuzilmasini Videostrongga qanday kuzatganini tushuntiradi. U 2025-yil oxirida sotib olingan MECOOL KM9PRO Max Android TV qutisida oldindan o'rnatilgan zararli dastur topilgandan so'ng buni aniqlagan.
Tekshiruv davomida Synthient zararli dastur file.anyevonline[.]com serverida operatorlar tomonidan ishlatiladigan orqa eshiklarni saqlaydigan ochiq katalogni topgan. Ochiq katalogda shuningdek Videostrong Technology Co. R&D direktori Owen Cao tomonidan yozilgan PDF faylni o'z ichiga olgan PDF papkasi ham bor edi.
Tadqiqotchilar shuningdek Videostrongning videostrong[.]cn domeni mqtt.anyevonline[.]com bilan bir xil IP manziliga ishora qilganini aniqlagan. Bu buyruq va nazorat serveri operatorlarga buzilgan qurilmalarni ro'yxatga olish, buyruqlar yuborish va ilovalarni o'rnatishni boshqarish imkonini bergan.
Bundan tashqari, Synthient Videostrong kompaniyasining ko'plab elektron pochta manzillari orqa eshiklarni imzolash uchun ishlatilganini aniqlagan.
Google aytishicha, dalillar ishlab chiqaruvchi zararli dasturiy ta'minotni qasddan o'rnatganini ko'rsatadi, bu esa xodimning yolg'iz harakati yoki rivojlanishdagi e'tiborsizlik emas.
"Biz bu kampaniya yolg'iz xodimning harakati yoki rivojlanishdagi e'tiborsizlik emas deb ishonamiz", — deb aytgan Google.
Google shuningdek sertifikatlash tekshiruvi jarayonini o'zgartirganini aytadi. Bu Videostrong xavfsizlik sinovlaridan qochish va qurilmalar birinchi marta ishga tushgandan keyin zararli kodni yuklash uchun niqoblash usullaridan foydalanganini aniqlagandan so'ng amalga oshirilgan.
Google aytishicha, yo'q qilish XCPE faoliyatini buzgan bo'lsa-da, zararli dastur yuqtirilgan qurilmalardan o'chirilmagan va agar o'chirilsa, /oem/ bo'limidan avtomatik ravishda qayta o'rnatiladi.
Shuning uchun foydalanuvchilar yuqtirishni yo'q qilish uchun toza proshivka o'rnatishi yoki keyingi zararli faoliyatni oldini olish uchun ta'sirlangan qurilmani internetdan uzishi kerak.
BleepingComputer botnet haqida qo'shimcha savollar bilan Google bilan bog'langan va agar javob olsak, hikoyani yangilaydi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring. MX o'zgarishlari talab qilinmaydi.
Bepul elektron pochta xavfsizlik skaneringizni boshlang.
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities.
The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately installing a persistent backdoor into devices it manufactured and selling access to criminal affiliates.
These affiliates used the backdoored devices to deploy malicious modules that were used fir ad fraud, turned infected devices into residential proxies, and installed additional malware.
As part of the disruption, Google says it took down XCPE command-and-control (C2) servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices.
These additional devices were compromised through malware distributed through other means than XCPE, and include retail set-top boxes, karaoke machines, and telehealth hardware. Google says that not all of them are Android devices.
Google has also terminated its relationship with Videostrong, revoked its license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.
"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google's Threat Intelligence Group (GTIG) said in a report published Monday.
Google says the disruption involved Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which coordinated to analyze the malicious infrastructure and disrupt its operations.
Unlike other botnets that commonly breach devices through vulnerabilities or by tricking users into installing malware, the XCPE botnet was embedded directly into device firmware during manufacturing.
Google says Videostrong had been developing and distributing the malware across multiple device brands and models for years, evolving its capabilities to evade detection and support different criminal affiliates.
"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google says.
The main backdoor component, tracked as x.cpe and com.oemservice, run with Android system-level privileges.
The malware uses a modular architecture that separates its backdoor functions from modules designed to generate revenue for affiliates.
After an infected device starts, XCPE contacts a command-and-control server on the anyevonline[.]com domain to obtain connection information and credentials for an MQTT message broker, which is then used for receiving commands.
Google says the malware uses different subdomains of anyevonline[.]com depending on the Android version and device type. The MQTT broker, which was hosted at mqtt.szbboys[.]com, allowed operators to send commands and deploy other malware to infected devices.
Through this connection, operators can remotely control compromised devices and perform malicious actions, such as:
- Silently downloading and installing additional Android applications.
- Disabling Google Play Protect.
- Executing shell commands and scripts with system privileges.
- Capturing screenshots and injecting keystrokes.
- Collecting account information, device details, installed application lists, and system logs.
- Conducting network reconnaissance and establishing reverse shells.
The devices were also used to generate revenue by installing malware modules belonging to other operators, turning the backdoor into a plug-in cybercrime platform for other cybercriminals.
According to Google, these modules included software associated with residential proxy services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, which was used to route third-party internet traffic through infected devices without their owners' knowledge or consent.
Other modules committed ad fraud by generating ad impressions, loading hidden webpages, and clicking advertisements. Some modules installed other backdoors, including Moyu, Spirit, and Bird, to download and execute other malware.
Google says the botnet operators continuously changed the malware's architecture to avoid detection.
In late 2024, Videostrong began using a separate loader called com.abc.nexus, which ran the malicious modules while XCPE focused on communications with the C2 infrastructure.
Since August 2026, the operators began replacing that loader with smaller, specialized droppers disguised as Android system applications.
Videostrong attribution
In a separate coordinated report, cybersecurity firm Synthient explains how it traced the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.
During its investigation, Synthient found a publicly accessible directory on the malware's file.anyevonline[.]comserver that hosted backdoors used by the operators. The open directory also included a PDF folder containing a PDF by Owen Cao, the R&D director of Videostrong Technology Co.
Researchers also found that Videostrong's videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline[.]com, the command-and-control server that allowed operators to list compromised devices, push out commands, and manage application installations.
In addition, Synthient discovered that numerous Videostrong company email addresses had been used to sign the backdoors.
Google says the evidence indicates the manufacturer deliberately installed the malware rather than a rogue employee or a development oversight.
"We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said.
Google also says it has modified its certification review process after discovering that Videostrong used obfuscation techniques to evade security testing and load malicious code after devices first booted.
While Google says the takedown has disrupted XCPE's operations, the malware has not been removed from in infected devices and will automatically reinstalls itself from the /oem/ partition if removed.
As a result, users would need to install clean firmware to remove the infection or disconnect the affected device from the internet to prevent further malicious activity.
BleepingComputer has contacted Google with additional questions about the botnet and will update the story if we get a response.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.