Google 1,3 million Android TV qurilmasini oldindan o'rnatilgan zararli dastur bilan yuqtirgan XCPE botnetini yo'q qildi

Google va sanoat hamkorlari XCPE botnetini yo'q qildi. Ushbu proshivka darajasidagi orqa eshik 1,3 milliondan ortiq Android pristavkalarini ro'yxatga oldi.

Google Threat Intelligence Group (GTIG) yuqori ishonch bilan baholaydiki, Android OEM va ODM Videostrong Technology Co. orqa eshikni foyda olish maqsadida qurdi va boshqardi. Google Threat Intelligence hisobotida bu ataylab qilingan, yovuz ichki xodim yoki ishlab chiqarish xatosi emasligi aytiladi.

XCPE zararli dasturi haqida umumiy ma'lumot (Manba: Google)

Videostrong orqa eshik kirishini jinoiy sheriklarga sotdi va ularning zararli dastur modullarini yuqtirilgan qurilmalarga yukladi. Modullar reklama firibgarligini amalga oshirdi, qurilmalarni yashirincha turar-joy proksi chiqish tugunlariga aylantirdi va qo'shimcha zararli dasturlarni o'rnatdi. Turar-joy proksilari trafikni oddiy uy IP manzillari orqali yo'naltiradi, bu esa hujumchilarga aniqlanishdan qochish imkonini beradi.

Google shuningdek, o'nlab sherik zararli dastur oilalarining buyruq va nazorat (C2) domenlarini ham buzdi. Ushbu sheriklar modullarni boshqa kanallar orqali ham tarqatadi, shuning uchun Google bu harakat kamida 10 million qo'shimcha buzilgan qurilmalarga kirishni kesishini kutadi.

Uch bosqichli arxitektura

Kamida 2024-yil oxiridan beri zararli dastur modulli dizayndan foydalanadi:

• Asosiy orqa eshik: x.cpe, ba'zan com.oemservice deb nomlanadi, proshivkada oldindan yuklangan va android.uid.system sifatida ishlaydi. Agar foydalanuvchi uni o'chirsa, u qayta yuklashda /oem/ bo'limidan qayta o'rnatiladi.
• Yuklovchi: com.abc.nexus tahlilga qarshi choralar va modul bajarilishini boshqaradi. U yaqinda har bir modulni alohida yuklaydigan droppers bilan almashtirildi.
• Monetizatsiya modullari: Bular Linkfog, AppSalt, NetNut va GaGaNode kabi proksi SDK-larini, shuningdek CBOXTV va HiddenView kabi reklama firibgarligi vositalarini o'z ichiga oladi.

Botnet ikki bosqichli buyruq va nazorat (C2) jarayonidan foydalanadi. Dastlab qurilmalar AES-shifrlangan apparat telemetriyasini o'z ichiga olgan HTTP POST so'rovini yuborib, o'z konfiguratsiyasini oladi.

Shundan so'ng ular mqtt.szbboys[.]com brokeriga doimiy MQTT ulanishini o'rnatadi. Ushbu MQTT ulanishi orqali operatorlar ilovalarni yashirincha o'rnatishi, qobiq buyruqlarini bajarishi, ekranlarni suratga olishi, tugmachalarni yozishi va jabrlanuvchi tarmoqlarini xaritalashi mumkin. Google teskari qobiqlar va hisob ma'lumotlari, paket ro'yxatlari va jurnallarni chiqarib olishni qayd etdi.

Orqa eshik package_verifier_user_consent ni -1 ga o'rnatish orqali Google Play Protect-ni o'chiradi. Shuningdek, yuklovchi libseccomp_guard.so ni joylashtirib, sandbox va asbob-uskunalarni oldini oladi.

2026-yil avgustidan beri operatorlar com.abc.nexus ni ommaviy ravishda o'chirib tashladi va com.android.system.ntp kabi tizim ilovalari sifatida niqoblangan droppersni surdi. Ba'zi variantlar libexploit.so dan foydalanib, Android Debug Bridge (adbd) ni ildiz huquqlari bilan qayta ishga tushiradi.

So'ngra ular tizim bo'limini o'qish-yozish rejimida qayta o'rnatadi va o'zlarini /system/priv-app/ ga nusxalaydi. persist.networkstack.uninstall kabi xususiyatlar operatorlarga tozalash jarayonlarini boshqarish imkonini beradi.

Videostrong Google-ning moslik sinovidagi bo'shliqdan foydalanib, qurilmaning dastlabki yuklanishidan keyin zararli kodni yukladi. Bunga javoban Google sertifikatlangan Android TV qurilmalari uchun o'z ko'rib chiqish jarayoni va proshivka yaxlitligi tekshiruvlarini qayta ko'rib chiqdi.

Google Videostrong 2024-yil oxirida x.cpe dan zararli modullarni olib tashlaganini aytdi, ehtimol BADBOX ga qarshi choralariga javoban. Ushbu botnet oilasi oldindan o'rnatilgan Android zararli dasturlarining uzoq tarixiga ega.

Popanet komponenti Google-ning NetNut buzilishidagi zararli dasturga mos keladi va avvalgi harakat allaqachon uning C2 infratuzilmasini yo'q qilgan. IPIDEA turar-joy proksi tarmog'ini buzganida 2026-yil yanvarida xuddi shu proksi iqtisodiyoti ishlagan.

Ko'pchilik jabrlanuvchilar Android TV pristavkalari. Google shuningdek, telemeditsina qurilmalari, karaoke mashinalari va raqamli belgilarida orqa eshikni topdi va ba'zi qurilmalar bir vaqtda uchta proksi SDK-ni ishlatgan. TrendAI 3-iyun va 1-oktabr o'rtasida 206 model bo'yicha 1 472 554 yuqtirilgan qurilmani sanadi va bu raqamni pastki chegara deb ataydi. Malayziya, Braziliya, Iroq, Meksika va Tayvan eng yuqori sonlarga ega.

Google Videostrong domenlari va serverlariga qarshi huquqiy choralar ko'rdi. Shuningdek, Videostrong va har qanday kelajakdagi sho'ba korxonalari yoki sheriklarini sertifikatlangan Android qurilmalarini qurish yoki sertifikatlangan sotuvchilarga dasturiy ta'minot yetkazib berishdan taqiqladi. Tergov Yaponiya Milliy Politsiya Agentligi, Lumen, HUMAN Security, Plume, Synthient va TrendAI ishtirokida o'tkazildi.

Egalari implantni o'zlari olib tashlay olmaydi. TrendAI tozalash sotuvchi chorasi, platforma himoyasi yoki qurilmani almashtirishni talab qiladi, deydi. Plume modullar qo'shimcha orqa eshiklar o'rnatgan bo'lishi mumkinligi sababli to'liq zavod sozlamalariga qaytarishni tavsiya qiladi. Biroq, bu qayta o'rnatish x.cpe ni olib tashlashini aytmaydi.

Yumshatish choralari

Tashkilotlar har qanday ta'sirlangan pristavkalarni almashtirishi kerak, chunki foydalanuvchi darajasidagi o'chirish ko'pincha samarasiz. Ular shuningdek, sertifikatlanmagan yoki noma'lum brendli Android TV apparat uskunalaridan qochishlari kerak. Agar qurilma buzilgan bo'lsa, potentsial zararni minimallashtirish uchun aqlli qurilmalarni mehmon tarmog'ida yoki alohida tarmoq segmentida ajratib qo'yish kerak.

Himoyachilar szbboys[.]com va anyevonline[.]com domenlariga trafikni bloklashi va kuzatishi kerak. Ular shuningdek, oqim qurilmalaridan keladigan kutilmagan MQTT yoki proksi trafikiga hushyor bo'lishlari kerak. Bundan tashqari, hamkorlar broker IP manzillari 219.134.163[.]210 va 219.134.163[.]211 ni bloklashni tavsiya qiladi.

Google orqa eshik operatorlari, reklama firibgarligi halqalari va turar-joy proksi provayderlari o'zaro bog'langan ta'minot zanjirini tashkil etishini ogohlantiradi. Uzoq muddatli buzilishni ta'minlash uchun ushbu infratuzilmaga doimiy bosim zarur.

Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1.3 million Android set-top boxes.

Google Threat Intelligence Group (GTIG) assesses with high confidence that Android OEM and ODM Videostrong Technology Co. built and operated the backdoor for profit. The Google Threat Intelligence report calls it intentional, not a rogue insider or a development oversight.

XCPE malware overview (Source: Google)

Videostrong sold backdoor access to criminal affiliates and loaded their malware modules onto infected devices. The modules ran ad fraud, silently turned devices into residential proxy exit nodes, and installed further malware. Residential proxies route traffic through ordinary home IP addresses, which lets attackers evade detection.

Google also disrupted the command-and-control (C2) domains of more than a dozen affiliate malware families. Those affiliates also distribute modules through other channels, so Google expects the action to cut access to at least 10 million additional compromised devices.

Three-Stage Architecture

Since at least late 2024, the malware has used a modular design:

• Primary backdoor: x.cpe, sometimes named com.oemservice, is preloaded in firmware and runs as android.uid.system. If a user removes it, it reinstalls from the /oem/ partition at reboot.
• Loader: com.abc.nexus handles anti-analysis and module execution. It has recently been replaced by droppers that load a single module each.
• Monetization modules: These include proxy SDKs such as Linkfog, AppSalt, NetNut and GaGaNode, and ad-fraud tools such as CBOXTV and HiddenView.

The botnet uses a two-stage command-and-control (C2) process. Initially, devices send an HTTP POST request containing AES-encrypted hardware telemetry to retrieve their configuration.

Following this, they establish a persistent MQTT connection to the broker mqtt.szbboys[.]com. Through this MQTT connection, operators can discreetly install applications, execute shell commands, capture screens, inject keystrokes, and map victim networks. Google noted reverse shells and the exfiltration of account data, package inventories, and logs.

The backdoor disables Google Play Protect by setting the package_verifier_user_consent to -1. Additionally, the loader deploys libseccomp_guard.so to prevent sandboxing and instrumentation.

Since August 2026, operators have mass uninstalled com.abc.nexus and pushed droppers disguised as system applications, such as com.android.system.ntp. Some variants utilize libexploit.so to restart the Android Debug Bridge (adbd) with root access.

They then remount the system partition as read-write and copy themselves into /system/priv-app/. Properties like persist.networkstack.uninstall allow operators to manage cleanup processes.

Videostrong exploited a gap in Google’s compatibility testing by loading malicious code after the device’s initial boot. In response, Google has since revised its review process and firmware integrity checks for certified Android TV devices.

Google said Videostrong removed malicious modules from x.cpe in late 2024, possibly in response to its enforcement against BADBOX. That botnet family has a long history of preinstalled Android malware.

The Popanet component matches malware from Google’s NetNut disruption, and that earlier action already took down its C2 infrastructure. The same proxy economy was at work when Google disrupted the IPIDEA residential proxy network in January 2026.

Most victims are Android TV set-top boxes. Google also found the backdoor on telehealth devices, karaoke machines and digital signage, and some devices ran as many as three proxy SDKs at once. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, and it calls that figure a lower bound. Malaysia, Brazil, Iraq, Mexico and Taiwan had the highest counts.

Google pursued legal action against Videostrong’s domains and servers. It also banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. The investigation involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Owners cannot remove the implant themselves. TrendAI says cleanup requires vendor action, platform protection, or device replacement. Plume recommends a full factory reset because modules may have planted extra backdoors. However, it does not say a reset removes x.cpe.

Mitigations

Organizations should replace any affected set-top boxes, as user-level removal is often ineffective. They should also avoid uncertified or off-brand Android TV hardware. To minimize potential damage if a device is compromised, isolate smart devices on a guest network or separate network segment.

Defenders should block and monitor traffic to the domains szbboys[.]com and anyevonline[.]com. They should also be vigilant for unexpected MQTT or proxy traffic originating from streaming devices. Furthermore, partners recommend blocking the broker IP addresses 219.134.163[.]210 and 219.134.163[.]211.

Google warns that backdoor operators, ad-fraud rings, and residential proxy providers form an interconnected supply chain. To achieve lasting disruption, continued pressure on this infrastructure is necessary.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.