1.3 Million TV Boxes Were Turned Into a ‘Botnet’ Without Owners Knowing

More than 1.3 million TV set-top boxes were secretly enrolled in a global botnet, allowing criminals to use the devices and their owners’ internet connections without their knowledge.

The operation, known as XCPE, relied on a hidden backdoor built into device firmware. Google Threat Intelligence Group says it has disrupted the operation and assesses with high confidence that Chinese device manufacturer Videostrong Technology Co. intentionally developed and operated the backdoor for financial gain.

The coordinated takedown, announced on November 2, involved Google, Japan’s National Police Agency and cybersecurity companies including Plume, Lumen, HUMAN Security, Synthient and TrendAI. The participating organisations reported that the affected devices were found across more than 200 countries.

The backdoor was already inside the devices

XCPE did not depend on owners clicking a suspicious link or downloading an unfamiliar application. The backdoor was built into the firmware of affected devices before they reached consumers.

Google’s investigation found that Videostrong used techniques to hide the malicious software from security checks. This allowed the backdoor to load additional malicious code after a device’s first boot.

Google said the operation was not simply an isolated employee’s actions or an accidental software mistake. It assessed with high confidence that Videostrong had intentionally developed, deployed and operated the backdoor to make money.

The company described a device manufacturer deliberately infecting customers’ devices as an “unacceptable breach of trust”.

How criminals used the infected TV boxes

The backdoor gave operators remote access to affected devices. Google said Videostrong monetised that access by selling it to criminal affiliates, who could load additional malicious software onto the boxes.

Researchers identified several ways the compromised devices were used:

• Residential proxy networks: Criminals could route internet traffic through a household’s connection, making that traffic appear to come from the home’s IP address.
• Advertising fraud: Malicious software used infected devices to support fraudulent advertising activity.
• Additional malware: The backdoor provided a way to install other malicious software on affected devices.

Google also reported activity involving data collection, data exfiltration and the routing of malicious network traffic through compromised devices.

For households, the concern is that a streaming box could be doing much more than playing videos. Its processing power and internet connection could be used for activity the owner never authorised.

Google disrupts the XCPE operation

Google and its partners took action to disrupt the domains and servers used to control the XCPE backdoor and deliver additional malware.

Google also disrupted command-and-control domains used by malware modules distributed through the wider affiliate network. The company estimates that this separate action could cut access to at least 10 million additional compromised devices.

That figure needs an important distinction: it is not an estimate of another 10 million XCPE-infected TV boxes. It refers to other compromised devices that could be affected by the disruption of the affiliates’ wider infrastructure.

Google has also cut ties with Videostrong and barred the company, along with its future subsidiaries and affiliates, from building or selling certified Android devices or supplying software to other certified vendors.

The company said it has strengthened its review process and firmware integrity checks to make it harder for similar malicious software to evade security testing.

Could your TV box be affected?

The investigation does not provide a complete public list that allows every TV box owner to check their device.

Synthient’s technical investigation specifically examined a MECOOL KM9PRO Max. Researchers identified a backdoor appearing as com.oemservice on that device and linked it to the wider Videostrong operation.

However, this finding does not establish that every MECOOL product is infected. Nor does it mean that every Android TV box or inexpensive streaming device is affected.

Google reported that the backdoor appeared across different device models and brands, but its public findings do not identify every affected model or individual device. A brand name, model appearance or low price alone cannot confirm whether a box is compromised.

There may also be no obvious warning. A device can continue playing videos normally while malicious software operates in the background. Normal performance is therefore not proof that a device is safe.

What should TV box owners do?

If you own an Android TV box, especially one from an unfamiliar seller or manufacturer, check its exact model and firmware details. You can then compare that information with the findings in Synthient’s technical investigation.

Contact the manufacturer or seller and ask whether your specific model and firmware are affected. Ask for confirmation of whether a verified clean firmware update or replacement is available. A general assurance that a device is safe is less useful than a clear answer about its exact model and software version.

If your device is confirmed to be affected, or you have strong reasons to suspect it is, disconnect it from your home network while you seek trustworthy advice or a replacement.

Do not assume that a factory reset or deleting an unfamiliar app will remove the backdoor. Synthient describes the malware as a persistent system-level component. Other technical reporting has also warned that firmware-level malware can survive ordinary removal attempts.

If you entered passwords or other sensitive information through a device you believe was compromised, change those passwords using a separate, trusted device. Review the relevant accounts for unfamiliar activity as well.

The important point is that a TV box does not have to stop working or display a warning to be involved in a criminal operation.

EDITORIAL TRANSPARENCY

How we checked this

We reviewed the original investigation, technical research and independent reporting before preparing this article.

This report is based primarily on the November 2 investigation published by Google Threat Intelligence Group. We also reviewed Synthient’s technical investigation, Plume’s research on the X.CPE botnet, and the coordinated takedown announcement.

We used The Register’s independent reporting for additional context. We distinguish Google’s findings about the XCPE operation from its separate estimate involving other compromised devices.

WHAT REMAINS UNKNOWN

Google’s public report does not identify every affected model or individual owner, or establish that every device made by Videostrong is infected. We have therefore avoided presenting unverified model lists as confirmed victims.