Google says TV box maker Videostrong built a backdoor into 1.3 million boxes and sold access: its assessment
Google says it assesses with high confidence that TV box maker Videostrong built the XCPE backdoor into firmware and sold access to criminal affiliates, enrolling more than 1.3 million boxes. The post names no court and no device models, and does not say how many boxes remain infected.
By Parminder Kumar Sharma · LinkedIn · · 20 min read
At least 11.3 million devices, and one name Google puts on the backdoor
Google Threat Intelligence Group's post of 2 November 2026 gives two device counts: more than 1.3 million set top boxes enrolled in the XCPE botnet, and, in its own words, "at least 10 million additional compromised devices" that it says lose their link to criminal operators when the affiliates' command domains go down. Added together, that is at least 11.3 million (derived: this site's sum; Google prints no total, and does not say whether the two groups overlap). The post is dated 2 November 2026 and describes the takedown as "last week", which puts it between 26 October and 1 November (derived from the post date). This briefing was written on the evening of 2 November from the post, read in full, and from two secondary reports.
The claim that gives the story its weight is not the count. It is the name. Google says it assesses "with high confidence" that the backdoor and botnet were "intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.", an Android original equipment and original design manufacturer. If that holds, the backdoor was not a user mistake or a poisoned download. It was in the firmware the box shipped with, and the maker sold access to others.
What that does not establish: a court finding, a reply from the company, a list of device models, or a count of boxes still infected. The post is Google's own assessment of its own investigation. It mentions legal action, but it names no court and links no filing. Everything below keeps Google's wording where wording matters.
What the post states, and what it leaves out
The table separates what Google's post prints from what it does not. The right hand column is the point: most of what a buyer or a network owner would ask next is there.
Stated and not stated in Google's post of 2 November 2026, read in full on 2 November 2026
| Question | Google's post says | Not stated |
|---|---|---|
| Who is responsible | Assessed with high confidence: Videostrong Technology Co., an OEM and ODM, built, deployed and operated the backdoor for financial gain. | Any court finding. Any reply from the company. Any named individual. |
| Where the backdoor sits | In the firmware: x.cpe, or com.oemservice in some builds, preloaded, running at system privilege, reinstalling from the /oem/ partition after a reboot. | Which firmware versions, or which build dates, carry it. |
| Which devices | "many different device models and brands" over multiple years; mostly Android TV set top boxes, plus telehealth devices, karaoke machines and digital signage. | Any model, brand or retailer list. How many of the 1.3 million were Play Protect certified. |
| What the devices did | Ad fraud, residential proxy exit nodes, further backdoors, data exfiltration; operators captured screenshots, injected keystrokes and took account data, package lists and system logs. | How many devices ran each job, or how much money moved. |
| What Google did | Legal action on Videostrong's domains and servers and on the command domains of over a dozen malware families; a ban on certified devices; firmware integrity changes; a changed review process. | The court, the case, the date, or whether every named domain is now offline. |
| How many are infected now | 1.3 million enrolled; at least 10 million more cut off from their affiliates. | How many still carry x.cpe. Any owner clean up steps. Whether Play Protect now blocks the packages. |
How the backdoor works, as Google describes it
Google calls the design modular and three stage. The first stage is the backdoor, a package preloaded in the firmware partition. If a user uninstalls it, Google says it "automatically reinstalls from the /oem/ partition upon reboot". The second is a loader, com.abc.nexus, which Google says is being phased out in favour of tailored droppers that each load one module. The third is the monetisation modules: residential proxy software, ad fraud engines and further backdoors, built by others than Videostrong, which Google calls affiliates.
Command is two stage too. A box first makes an HTTP request for settings, then holds an MQTT connection to a broker. Google says all samples it analysed use one broker hostname, resolved by two addresses, on non standard ports. Through that channel operators can order silent installs, run shell commands, take screenshots and send keystrokes. Google's reading of the C2 logs is that most traffic was module install, uninstall and configuration.
Two details carry the argument that this was a design and not an accident. First, Google says the backdoor "first wipes user consent configuration on the device and then disables Google Play Protect", so later installs run without prompts. Second, it says one proxy module checks where it was installed from and stops if the source was the official Google Play Store. Software that behaves differently when watched by the store is built to avoid inspection.
From August 2026, Google says new droppers disguised as system packages arrived over the same channel, timed with the mass removal of the older loader. Some variants carry a native file that restarts the local debug service as root and uses it to copy themselves into the system partition, which makes them harder to remove. Google calls this a possible new evolution to avoid detection.
What the boxes were used for
Google lists four jobs: ad fraud, residential proxy traffic, additional malware and data exfiltration. The proxy modules turn a living room box into an exit node, so strangers' traffic leaves from the owner's home address. Google names the SDKs it found, among them Linkfog, AppSalt (owned by Honeygain, which Google says is owned by Oxylabs), NetNut's Popanet, GaGaNode, Traffmonetizer and EarnFM, and says "as many as three residential proxy SDKs" ran on one device. The ad fraud modules, Fission and HiddenView, load hidden pages and fire tracking requests to register ad views no one saw.
Naming a vendor here is Google's reporting, not a finding about that vendor's knowledge. Google's own sentence about the proxy industry is more careful: operators of residential proxy networks seek consent "when they are forced due to platform policy", and silent opt in is "the most prevalent means" of enrolling a device. In the AppSalt case Google describes an opt in call made with no consent screen.
Google does not say the operators stole money from the box owners, drained accounts or read private files. It says operators took account information, device information, package inventories and system logs, took live screenshots, injected keystrokes and opened reverse shells. Those are capabilities and observed actions. How many boxes got which treatment is not stated.
What "disrupted" means in this post, and what it does not
Google lists four actions. Reading them one at a time, each is narrower than the headlines that followed.
Google's four listed actions and what each does and does not do, from the post of 2 November 2026
| Action (Google's wording) | What it reaches | What it does not say |
|---|---|---|
| Legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules | The command channel and the staging for new modules. | Which court, which orders, or that the firmware backdoor on a box is removed. |
| Legal action to take down command domains used by over a dozen malware families | Affiliates' control of the modules, and by Google's assessment at least 10 million further devices. | That the modules stop running on a box that already has them. |
| Banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices, or supplying software to certified vendors | Future certified devices and certified supply chains. | Anything about the uncertified boxes the firm may sell. The post does not say it can no longer sell boxes. |
| Improvements to firmware integrity on certified Android TV devices, and changes to its review process | How new certified devices are checked, after a gap in the tests. | What changed, from when, or whether boxes already shipped are checked. |
Help Net Security's headline says Google "bans the company behind it" and its first sentence says Google "shut down the servers". The post says legal action to take the domains and servers down, and a ban from certified devices and software supply. Those are different things from closing a company or switching off every server, and the post does not claim to have done either.
Google is open about the limit. It says point in time disruptions are a critical tool but "lasting disruption" will need continued targeting, and that backdoor operators, ad fraud rings and proxy providers "operate as an interconnected supply chain" that pivots when one part falls.
"Sold criminal access": an assessment, worded as one
The Hacker News headline says Google "Says TV Box Maker Sold Criminal Access". Google's own wording is that Videostrong "monetized the backdoor by selling access to criminal affiliates" and that it assesses this "with high confidence". The post does not describe a payment, a contract or a communication between Videostrong and any affiliate. The evidence it points to is architecture and behaviour: the malicious code built into many models over years, dedicated infrastructure, configuration that managed affiliates, and the maker's own command channel loading affiliates' modules onto the boxes.
Google also rules out a smaller explanation in one sentence: "We believe this campaign wasn't an isolated rogue insider or a development oversight." That is a belief and a reasoned inference from scale and persistence, stated as such. It is not a fact established in a courtroom. Whether Videostrong, its staff or a downstream distributor would dispute it is not in any source read for this briefing.
The friendly name here is "certified"
In July 2025 Google described the BadBox 2.0 botnet as made of "uncertified devices" running the open source Android code, which lacks Google's protections, and said it had filed a lawsuit in New York federal court. That made the advice easy: buy certified. The XCPE post complicates it. Google says Videostrong went through its compatibility and security tests and then "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot".
The ban Google announces covers "certified Android devices", and the firmware changes cover "certified Android TV devices". Read together, those wordings imply Videostrong's boxes were in Google's certified programme. The post does not say how many of the 1.3 million boxes were certified, and it does not say that all of them were. That is an inference, labelled as one.
A certification label is a control only as far as its tests are. Google's own admission is that a test gap let late loaded code through. It has changed its review, but nobody outside Google can inspect that change. Google's consumer advice is still to buy from reputable manufacturers and consult its Android TV partner list. This site read the linked page on 2 November 2026: it describes Play Protect certified phones and tablets and its text does not contain the name Videostrong. Whether that page lists set top box makers is not something the page text settles.
Where the coverage adds or changes the primary
Both secondary reports were published on 2 November 2026. The Hacker News article page answered this site's agent with a Cloudflare challenge; this site did not try to get past it and read only the item text in the publication's feed, which is cut off after three short paragraphs. Help Net Security's page was read in full.
Google's post compared with the feed item of The Hacker News and the article of Help Net Security, all read 2 November 2026
| Point | Google, the primary | The Hacker News feed item | Help Net Security |
|---|---|---|---|
| Count | More than 1.3 million set top boxes enrolled | More than 1.3 million Android devices, mostly TV set top boxes | More than 1.3 million devices enrolled |
| When | "Last week", in a post dated 2 November | "late October" | No date for the takedown given |
| Servers | Legal action to take down domains and servers | The botnet "lost control of its servers" | Headline: shut down the servers; later: took legal action |
| The ban | From building and selling certified Android devices and supplying software to certified vendors | Not in the feed text | "bans the company" in the headline; the body repeats Google's scope |
| Wording on blame | Assess with high confidence; intentionally developed, deployed and operated | Says Google is highly confident the maker "intentionally put a backdoor in the boxes and sold access" | Attributes with high confidence; calls Videostrong the company that manufactured many of the boxes |
| Removal | Cannot be removed by the user; reinstalls from the /oem/ partition | Not in the feed text | Says it reinstalls from a "protected partition", a gloss on Google's wording |
Help Net also carries a comment from an executive at HUMAN Security, one of the named partners, on why disrupting infrastructure raises the cost of running such networks. This site leaves the person unnamed. It is the partner's view of the approach, not a fact about XCPE. Neither secondary report adds a model list, a court or a reply from the maker, and neither contradicts Google's numbers.
Where the boxes are, and which ones
Google says the botnet is "globally dispersed, with certain concentrations possibly implying market penetration for the brand distributor", and shows a shaded world map without a legend or numbers. Reading the map by eye, and so as this site's reading and not Google's: the darkest shading falls on Brazil, Iraq and parts of Malaysia, with lighter shading across North America, Europe, Russia, Turkey, South Africa, Australia and parts of Southeast Asia. Google gives no country counts. A configuration sample it prints carries a region field set to Iraq, assigned to a server pool, which fits that shading but is a single sample.
On models and brands the post is silent beyond "many different device models and brands". Two strings in its code samples look like product names: a streaming player app called YokaTV Player, and a system property that includes the word mecool. Google does not say what either is, and a code string is not an accusation against a brand or a retailer. A buyer cannot check a box against a list, because the post does not print one.
What happens to boxes already in homes
Google says what the backdoor does, not what happens after the takedown. Its statement is that x.cpe cannot be removed by the user and reinstalls after a reboot. It says nothing about a factory reset, an update from the maker, or a patch from Google that clears it. The reasonable inference, which is this site's and not Google's, is that cutting the command domains removes the operators' ability to give orders, but leaves the preloaded firmware component on the box, so the box is still compromised hardware. Whether it keeps calling domains that no longer answer is also not stated.
The post also does not say that Play Protect now detects and blocks the XCPE packages, as Google did for BadBox 2.0 in 2025. The one protection Google tells consumers to check is that Play Protect is active, while the same post says the backdoor switches off app verification. A box that reports Play Protect as on is therefore weak evidence on a box that may carry this backdoor.
Technical details
Everything here is copied from Google's post as it prints it, read on 2 November 2026, with live infrastructure defanged. Google prints no exploit code and none is reproduced. Two things were left out on purpose: the module configuration figure, because its download addresses point to accounts on a code hosting service, and the eleven operator account addresses on that service in Google's indicator table, because they are accounts which may belong to private individuals. The first block is the bootstrap routine; it tells a network owner which host names and endpoints an infected box would call.
Queries content://com.release.debug.provider/configs for private_url via x.cpe.util.ExtraReadUtils.
Queries the Android system property to determine if ro.mecool.device is true.
If true, it defaults to hxxp://mcstb[.]anyevonline[.]com:8000
If false, it dynamically generates the following: hxxp://stb[AndroidVersion][Type][.]anyevonline[.]com:8000.
Endpoints on the bootstrap host: /router/config/mqtt , /router/config/acs , /router/config/app
Broker: mqtt.szbboys[.]com, ports 3885-3887 (devices). Operators, likely: HTTP REST API port 8082, WebSocket port 8083, EMQX web administration console port 18083.
Names, paths and settings. These are the package names, partitions, properties and files that appear in the post's prose. A defender can hunt for them on a managed Android device image, or in an inventory of installed packages. The one setting that matters most is package_verifier_user_consent, which Google says the backdoor sets to minus one through Settings.Global.putInt to disable Google Play Protect app verification.
android.uid.system | privilege level the x.cpe backdoor runs at
x.cpe (running as com.oemservice in some builds) | the preloaded backdoor package
/oem/ | partition x.cpe reinstalls itself from after a reboot
/data/app/ | where the reinstalled x.cpe package runs
package_verifier_user_consent | global setting set to -1 to disable Play Protect app verification
com.abc.nexus | the loader and execution engine
com.release.debug.provider , com.oem.share.provider | content providers named in the post
ext/lib/config | MQTT action that pushes module configuration
libseccomp_guard.so | anti analysis utility extracted by many com.abc.nexus variants
com.android.system.ntp , com.android.sso.auth.handler | dropper packages disguised as system apps, since August 2026
libexploit.so | native file the dropper packages extract to gain root over adb
persist.networkstack.uninstall , persist.networkstack.skip_system_install , persist.networkstack.install_time | properties operators set by script
/system/priv-app/ | where the dropper copies itself
/system/etc/permissions/privapp-permissions-.xml | file created to grant permissions
android.permission.INSTALL_PACKAGES , android.permission.REBOOT | permissions the file grants
Configuration messages the broker pushes to a box. Google prints four fragments of JSON from the ext/lib/config action: resource limits for a proxy module, a server pool assignment, a module on or off list, and the reply a box publishes. They show a managed service: resource caps to avoid being noticed, per region pools and per module switches, only the Linkfog module enabled in the sample.
Figure 4: System resource limits configuration payload
"constraints": [
{
"cpu": 70,
"ioRead": 5000,
"ioWrite": 5000,
"libCode": "linkfog",
"memory": 50,
"reportAlarm": true,
"trigger": 3
}
Figure 6: Server Pool configuration payload
"region": "Iraq",
"serverPool": {
"defaultPool": "Pool5",
"lastUpdated": "2025-08-06 17:00:00",
Figure 7: Module activation payload
"status": [
{
"enable": true,
"libCode": "linkfog"
},
{
"enable": false,
"libCode": "bwm"
},
{
"enable": false,
"libCode": "adtime"
},
{
"enable": false,
"libCode": "admoyu"
},
{
"enable": false,
"libCode": "titan"
},
{
"enable": false,
"libCode": "lb102"
}
],
Figure 8: x.cpe response payload
"code": 0,
"msg": "success",
"data": "received data success and applying",
"async": true,
"immediately": false
Network indicators for XCPE itself. Google's table lists 10 rows with the XCPE or YokaTV label: two broker addresses, two file hosting and command addresses, the registration, core and fallback domains. Search DNS and firewall logs for them, and for any device that connects to the broker on ports 3885 to 3887. Google notes that operators probably manage the broker from addresses outside the botnet's own range.
Indicator | Type | Label | Notes
219[.]134[.]163[.]210 | IP Address | XCPE | Hosts MQTT C2 Broker
219[.]134[.]163[.]211 | IP Address | XCPE | Hosts MQTT C2 Broker
23[.]94[.]49[.]57 | IP Address | XCPE | File hosting and command and control server
38[.]145[.]197[.]135 | IP Address | XCPE | Hosts anyevonline[.]com and file server
*[.]anyevonline[.]com | Subdomains | XCPE | Registration C2 subdomains
intermedia-arts[.]tv | Domain | XCPE | Fallback C2 for system packages
szbboys[.]com | Domain | XCPE | Hosts core C2 for XCPE
ott[.]szbboys[.]com | Subdomain | XCPE | Supports file upload and download and OTA updates
mqtt[.]szbboys[.]com | Subdomain | XCPE | MQTT C2 broker
yokatvonline[.]com | Domain | YokaTV | Fallback C2 for system packages
Network indicators for the affiliate modules. The other 147 rows are command domains of the modules loaded through the backdoor: 100 labelled Honeygain / AppSalt, 17 Moyu, 6 Linkfog and the rest across Bird, EarnFM, Fission, GaGaNode, HiddenView, IPWeb, Jaguar, Spirit and Traffmonetizer (counts of rows as printed). Google says these affiliates also spread through channels other than XCPE, so a hit on one of these is not proof that a box carries x.cpe. Taking the 157 network rows together, 11 further rows name operator code hosting accounts and are omitted here.
Indicator | Type | Label | Notes
amhib[.]com | Domain | Bird
disview[.]com | Domain | Bird
prataw[.]com | Domain | Bird
auqee[.]com | Domain | Bird
alptk[.]com | Domain | Bird
mfiny[.]com | Domain | Bird
leisurepuz[.]com | Domain | Bird
earn[.]fm | Domain | EarnFM
geo-loadbalanced[.]com | Domain | EarnFM
collection[.]shixunsuda[.]com | Subdomain | Fission
analysis[.]shixunsuda[.]com | Subdomain | Fission
gtxvdqvuweqs[.]com | Domain | Gaganode
hiddeninplainsight[.]top | Domain | HiddenView
absolut[.]fit | Domain | Honeygain / AppSalt
alpivara[.]com | Domain | Honeygain / AppSalt
beepityping[.]com | Domain | Honeygain / AppSalt
beezlepongmad[.]com | Domain | Honeygain / AppSalt
bloopondle[.]com | Domain | Honeygain / AppSalt
blustpong[.]com | Domain | Honeygain / AppSalt
braigwshat[.]com | Domain | Honeygain / AppSalt
brisping[.]com | Domain | Honeygain / AppSalt
bronglepong[.]com | Domain | Honeygain / AppSalt
clapslpist[.]com | Domain | Honeygain / AppSalt
clapslport[.]com | Domain | Honeygain / AppSalt
craipivolta[.]com | Domain | Honeygain / AppSalt
creapslpinut[.]com | Domain | Honeygain / AppSalt
crodipolis[.]com | Domain | Honeygain / AppSalt
delpiverno[.]com | Domain | Honeygain / AppSalt
depomancy[.]com | Domain | Honeygain / AppSalt
dewswyra[.]com | Domain | Honeygain / AppSalt
drackpingcare[.]com | Domain | Honeygain / AppSalt
dramapi[.]com | Domain | Honeygain / AppSalt
drapithon[.]com | Domain | Honeygain / AppSalt
fawsilver[.]com | Domain | Honeygain / AppSalt
fawsindra[.]com | Domain | Honeygain / AppSalt
fizzlepong[.]com | Domain | Honeygain / AppSalt
flaigwern[.]com | Domain | Honeygain / AppSalt
flapilo[.]com | Domain | Honeygain / AppSalt
flapslwstorm[.]com | Domain | Honeygain / AppSalt
flawsino[.]com | Domain | Honeygain / AppSalt
flewsnark[.]com | Domain | Honeygain / AppSalt
floporin[.]com | Domain | Honeygain / AppSalt
floppipple[.]com | Domain | Honeygain / AppSalt
flumpipoodle[.]com | Domain | Honeygain / AppSalt
frosping[.]com | Domain | Honeygain / AppSalt
gapslpinch[.]com | Domain | Honeygain / AppSalt
gapslwsbor[.]com | Domain | Honeygain / AppSalt
glapoton[.]com | Domain | Honeygain / AppSalt
glewsnap[.]com | Domain | Honeygain / AppSalt
glippinger[.]com | Domain | Honeygain / AppSalt
gloobfnatch[.]com | Domain | Honeygain / AppSalt
gloopong[.]com | Domain | Honeygain / AppSalt
glowspar[.]com | Domain | Honeygain / AppSalt
grasplpond[.]com | Domain | Honeygain / AppSalt
grinapslpocal[.]com | Domain | Honeygain / AppSalt
hawsith[.]com | Domain | Honeygain / AppSalt
lapslponze[.]com | Domain | Honeygain / AppSalt
lepovia[.]com | Domain | Honeygain / AppSalt
limpingcare[.]com | Domain | Honeygain / AppSalt
lorapslpifyx[.]com | Domain | Honeygain / AppSalt
lowswyn[.]com | Domain | Honeygain / AppSalt
lunapiris[.]com | Domain | Honeygain / AppSalt
mopith[.]com | Domain | Honeygain / AppSalt
mudponger[.]com | Domain | Honeygain / AppSalt
nepiral[.]com | Domain | Honeygain / AppSalt
opostra[.]com | Domain | Honeygain / AppSalt
pibberflop[.]com | Domain | Honeygain / AppSalt
pikaroodle[.]com | Domain | Honeygain / AppSalt
ploponix[.]com | Domain | Honeygain / AppSalt
qepoth[.]com | Domain | Honeygain / AppSalt
rapinel[.]com | Domain | Honeygain / AppSalt
rapslpine[.]com | Domain | Honeygain / AppSalt
rapslponic[.]com | Domain | Honeygain / AppSalt
rapslwsweave[.]com | Domain | Honeygain / AppSalt
raspongle[.]com | Domain | Honeygain / AppSalt
ripotus[.]com | Domain | Honeygain / AppSalt
rowswyn[.]com | Domain | Honeygain / AppSalt
scapslwshell[.]com | Domain | Honeygain / AppSalt
snarpong[.]com | Domain | Honeygain / AppSalt
snorpdoodle[.]com | Domain | Honeygain / AppSalt
sofpilan[.]com | Domain | Honeygain / AppSalt
soporth[.]com | Domain | Honeygain / AppSalt
spopel[.]com | Domain | Honeygain / AppSalt
tawserin[.]com | Domain | Honeygain / AppSalt
tawswizzle[.]com | Domain | Honeygain / AppSalt
teowsmera[.]com | Domain | Honeygain / AppSalt
tepiol[.]com | Domain | Honeygain / AppSalt
tewsmariel[.]com | Domain | Honeygain / AppSalt
thaiporix[.]com | Domain | Honeygain / AppSalt
thapolex[.]com | Domain | Honeygain / AppSalt
torpoodle[.]com | Domain | Honeygain / AppSalt
trapslwsin[.]com | Domain | Honeygain / AppSalt
trawsica[.]com | Domain | Honeygain / AppSalt
tripikazu[.]com | Domain | Honeygain / AppSalt
twindping[.]com | Domain | Honeygain / AppSalt
vaiporun[.]com | Domain | Honeygain / AppSalt
vespilara[.]com | Domain | Honeygain / AppSalt
vorpolis[.]com | Domain | Honeygain / AppSalt
whispong[.]com | Domain | Honeygain / AppSalt
winklenark[.]com | Domain | Honeygain / AppSalt
wizzleplonk[.]com | Domain | Honeygain / AppSalt
wogglenift[.]com | Domain | Honeygain / AppSalt
yapodust[.]com | Domain | Honeygain / AppSalt
yewsara[.]com | Domain | Honeygain / AppSalt
zarflonk[.]com | Domain | Honeygain / AppSalt
zenapslpinic[.]com | Domain | Honeygain / AppSalt
zerapslpomat[.]com | Domain | Honeygain / AppSalt
zimpire[.]com | Domain | Honeygain / AppSalt
zingpingbees[.]com | Domain | Honeygain / AppSalt
zippypongbee[.]com | Domain | Honeygain / AppSalt
zoraipinex[.]com | Domain | Honeygain / AppSalt
zorapslwsnic[.]com | Domain | Honeygain / AppSalt
zrawsomble[.]com | Domain | Honeygain / AppSalt
bestipip[.]com | Domain | IPWeb
fecebbbk[.]xyz | Domain | IPWeb
guangzhouroot[.]com | Domain | IPWeb
bd-devmetrics[.]net | Domain | Jaguar
jaguar-distributor[.]logreporter[.]com | Subdomain | Jaguar
jaguar-distributor[.]syslogcollector[.]com | Subdomain | Jaguar
tx-devmetrics[.]net | Domain | Jaguar
linkfog[.]cn | Domain | Linkfog
cloudbrokerapi[.]xyz | Domain | Linkfog
dddlink[.]link | Domain | Linkfog
smrtai[.]cc | Domain | Linkfog
bkdomain[.]cn | Domain | Linkfog
columbus2024[.]com | Domain | Linkfog
dmurdce[.]xyz | Domain | Moyu
edisajalsjfdfh[.]shop | Domain | Moyu
fshuaons2[.]online | Domain | Moyu
fuioahsdoa3[.]store | Domain | Moyu
fuisans1[.]online | Domain | Moyu
haimnsgsjhansj[.]shop | Domain | Moyu
ishano456[.]sbs | Domain | Moyu
ishuoabh3years[.]online | Domain | Moyu
sdoisanadf[.]shop | Domain | Moyu
shaiosjdaln[.]shop | Domain | Moyu
shsuanalsjai[.]shop | Domain | Moyu
ty4523[.]space | Domain | Moyu
ty54fgd435[.]my | Domain | Moyu
ue886578433[.]online | Domain | Moyu
vrr8345[.]site | Domain | Moyu
xmsae[.]sbs | Domain | Moyu
xshaon123[.]sbs | Domain | Moyu
dgjm[.]online | Domain | Spirit
drgdj[.]top | Domain | Spirit
spiritlib[.]cyou | Domain | Spirit
*[.]traffmonetizer[.]com | Subdomains | Traffmonetizer
File hashes. Google lists 65 representative SHA256 values: 35 for x.cpe, 12 for com.oemservice, 13 for com.abc.nexus, and one each for four related files. A hash only matches a sample byte for byte, so it helps when checking a firmware image or a package extracted from one, and little when checking a running box.
Package or file | SHA256
x.cpe | 3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18
x.cpe | 4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0
x.cpe | 8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c8194
x.cpe | 92326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c75176
x.cpe | 17d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a894
x.cpe | 76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b2
x.cpe | 05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d22
x.cpe | da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104
x.cpe | 471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc
x.cpe | 39792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d435922
x.cpe | 2cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b
x.cpe | dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99
x.cpe | 20af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d
x.cpe | f451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4
x.cpe | 0d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea8690867
x.cpe | 22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd2
x.cpe | 6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d5612
x.cpe | 049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c0
x.cpe | bcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230
x.cpe | 1806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a4
x.cpe | 9216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f2
x.cpe | 04ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c
x.cpe | 3e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6
x.cpe | 415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b
x.cpe | 9df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb
x.cpe | be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97dedd
x.cpe | 8953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee
x.cpe | 01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde
x.cpe | 5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a
x.cpe | 085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d
x.cpe | 07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179
x.cpe | 02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62
x.cpe | 6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291
x.cpe | 1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200
x.cpe | 486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa
com.oemservice | 350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4
com.oemservice | 2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed
com.oemservice | 99874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa8
com.oemservice | 4fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd
com.oemservice | cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4
com.oemservice | 3627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd9785
com.oemservice | 0ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc60
com.oemservice | 1c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd63
com.oemservice | 1c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c53
com.oemservice | 1c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd
com.oemservice | 498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f9
com.oemservice | b2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0
com.abc.nexus | 1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960
com.abc.nexus | a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7
com.abc.nexus | 3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f
com.abc.nexus | c0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5
com.abc.nexus | 0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9
com.abc.nexus | 83b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea30
com.abc.nexus | 02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3
com.abc.nexus | 69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb
com.abc.nexus | 7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d
com.abc.nexus | d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4
com.abc.nexus | e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0
com.abc.nexus | cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903
com.abc.nexus | 08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f1
com.vs.grass | fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2
libseccomp_guard.so | b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b
com.android.sso.auth.handler | ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed
libexploit.so | 42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135
libnative_keys.so | 7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42
Google's table also gives rows for affiliate APKs, ELF files and DEX files with notes; their hashes are on the post. This site did not copy those rows.
What to do, in the order worth doing it
Ranked by what the post supports. Where an item is this site's suggestion and not Google's, it says so. The post gives owners no clean up procedure.
Take this with you
Checklist for owners of Android TV and set top boxes, and for the networks they sit on
- Find every Android based TV box, streaming stick, digital signage player and karaoke or telehealth device on the home or office network from the router's client list, and write down the brand and model. Google names no models, so a list match is not possible. This site's suggestion.
- If you run a network, search DNS and firewall logs for the XCPE hosts, addresses and ports in the Technical details section. Google publishes these as indicators; a hit is a strong reason to isolate the device.
- Isolate any box you cannot vouch for: move it to a guest network with no path to computers or storage, or unplug it. This site's suggestion. Do not rely on deleting an app: Google says the backdoor reinstalls itself from /oem/ after a reboot and "cannot be removed by the user".
- Do not trust the box's own Play Protect screen. Google says the backdoor switches off app verification. Use network evidence, not the device's report. This site's inference from Google's description.
- Do not factory reset and assume the problem is gone. Google does not say a reset removes it, and the component lives in the firmware's own partitions. Replacing the device is the safer reading. This site's inference.
- Stop installing apps that pay for "unused bandwidth" or "sharing your internet". Google calls these a primary way illicit proxy networks grow and says they could open security holes on the home network.
- For buyers and procurement: Google advises buying connected devices only from reputable manufacturers and points to its Android TV partner list. This site adds that certification was not enough here, so treat no name boxes sold with preinstalled apps as high risk, and ask for independent security audits of the manufacturer, which Google says retailers and distributors should require, with prompt delisting of any maker implicated in supply chain abuse.
- For retailers and platforms: Google names downstream brands, white label resellers, telecoms providers and online marketplaces as sharing responsibility. Check whether any box you sell or supply matches the device types in this briefing, and ask the supplier in writing about firmware and update channels.
The question that exposes the gap
Google's account removes the comfortable idea that a backdoor reaches a home through a mistake by the owner. It says the maker shipped it, for years, and that a label Google itself issues did not stop it. The takedown is real as far as it goes, but it addresses the operators' infrastructure, not the plastic box in the lounge.
So the question for anyone who bought, deployed or sold these boxes is this: if the device was certified, preloaded with software you never chose, and cannot be cleaned by its owner, who is accountable for it now, and where is the list that tells you whether yours is one of them?
Sources read for this briefing: Google Threat Intelligence Group, the primary; Google's July 2025 BadBox 2.0 post and its Android certified partners page, both linked from the primary; Help Net Security; and the item text in The Hacker News feed. The two news reports are secondary and are not the source of any fact here that is not also in Google's post.
Key facts
Sources
- PrimaryShutting the Door on the XCPE Botnet, 2 November 2026. The primary, read in full: assessment, actions, malware analysis, infrastructure, call to action, Figures 1 and 3 (both used), and the indicator tablesGoogle Threat Intelligence Group (Google Cloud Blog)accessed 2026-11-02
- PrimaryGoogle takes legal action against Badbox 2.0 cyberattack, 17 July 2025: linked from the primary as earlier Google enforcement; used for the uncertified devices wording and the New York lawsuitGoogle (The Keyword)accessed 2026-11-02
- PrimaryAndroid certified partners page, linked from the primary as the Android TV website: page text read for the Play Protect certified wording and a search for the name VideostrongAndroid (Google)accessed 2026-11-02
- Reported byGoogle disrupts XCPE botnet, bans the company behind it, 2 November 2026: secondary report, read in full; compared with the primaryHelp Net Securityaccessed 2026-11-02
- Reported byItem text for Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access, 2 November 2026: secondary; the article page answered with a Cloudflare challenge and was not read, so only the short feed text was usedThe Hacker News (publication feed)accessed 2026-11-02
