The Backdoor Came in the Box: What 1.3 Million Set-Top Boxes Teach OT About Trust

Amigos, most of the time when we talk about compromised devices, we mean someone broke in. This time, the door was already there when the box left the factory.

On Monday, November 2, Google’s Threat Intelligence Group announced that Google and industry partners had dismantled X.CPE (also written XCPE), a backdoor that enrolled more than 1.3 million devices into a botnet. The action itself happened the week of October 26. And the twist that should make every OT person sit up: the implant wasn’t a vulnerability. There is no CVE. According to Google, with high confidence, the device maker built it, shipped it and sold access for profit.

What actually happened

X.CPE lived mostly on Android TV set-top boxes, the cheap streaming sticks and media boxes people plug into the living room TV. Google also saw it on telehealth devices, karaoke machines and digital signage. TrendAI adds projectors to that list. So this isn’t only a consumer story. Some of those boxes sit in clinics, lobbies and conference rooms.

The partners named by Google, in order: Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Japan’s NPA later confirmed its role. Fukuoka police had found malicious apps on IoT devices in September 2025 while chasing an internet banking fraud case, and Japan has been sharing information with Google since March 2026.

Here’s the architecture at a defensive level. A system-privileged stub (packages like x.cpe and com.oemservice) came preloaded in firmware. It reinstalled itself from the /oem/ partition after a reboot. Owners never installed anything. Plume put it plainly: “this threat arrived as part of the device itself.” After first boot, the stub pulled modules. It disabled Google Play Protect. Operators could silently install apps, take screenshots, inject keystrokes, run shell commands as system and open reverse shells. Control ran through an MQTT broker.

And mira, Videostrong Technology Co., a Shenzhen-based Android OEM and ODM, didn’t run every scam itself. Google says the company sold access to affiliates. Those affiliate modules handled residential proxies and advertising fraud, and loaded more malware. A single box could run up to three proxy SDKs at once. TrendAI measured about 1.33 million devices scheduled for proxy and ad-fraud modules, more than 3.8 million distinct residential exit IPs, and devices in more than 170 countries, between June 3 and October 1, 2026.

Google also assesses that taking down the affiliates’ C2 domains will cut off access to at least 10 million more compromised devices infected through other channels. That 10 million figure is Google’s assessment. Those devices were not part of X.CPE, and Google’s post does not call them IoT.

MECOOL is the best-known brand involved. That doesn’t mean every MECOOL box is infected, and it doesn’t mean every infected box was a MECOOL.

What “dismantled” actually means

Por favor, don’t leave this post thinking the boxes are clean.

Google took legal action to take down the domains and servers Videostrong used to control the botnet and install modules, plus C2 domains for over a dozen malware families. Google also banned Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices, or supplying software to certified vendors, and says it improved firmware integrity checks for certified Android TV devices.

TrendAI is clear: “The removal of these servers cut the operator off from the devices, although the implant remains on each box.” A factory reset may not pull a firmware preload. BleepingComputer, TrendAI and Synthient all point toward replacement or disconnection as the safe advice. Google itself says point-in-time disruptions matter, but lasting disruption will take continued pressure on this kind of infrastructure.

Call it legal action, not a lawsuit. As of Nov 5, no public complaint naming Videostrong was found.

Why I’m writing about TV boxes on an OT blog

Let me be clear first. No source reports any compromise of ICS or OT systems. There’s no nation-state link either. TrendAI says explicitly that nothing here should be read as evidence that nation-state actors used this fleet. This is financially motivated cybercrime.

So why care, familia?

Because the lesson is upstream. If a vendor can preload a backdoor into a certified Android TV box, any cheap Android device on a plant or utility network, a signage player, a kiosk, a conference room stick, deserves the same suspicion. ISP-supplied gear that subscribers can’t swap out is a cousin of vendor-supplied OT gateways. You trust the brand. The brand shipped the door.

There’s also a network lesson. Residential proxy traffic looks like home users. TrendAI notes that blocklists of data-center ranges would not and did not catch this traffic. If your remote access for vendors or operators still leans on “looks like a residential IP in the right country,” you’re trusting a signal criminals can buy. TrendAI also warns that if these devices sat on an organizational network, the attacker could reach the internal network too. Google lists network reconnaissance and reverse shells among the operator powers. That is not an OT hit. It is a reminder that a “dumb” Android box on the wrong VLAN is a foothold.

And the certification story should sting a little. Some infected boxes were Google-certified. Google says Videostrong used obfuscation to exploit a gap in tests and load malicious code after first boot. Google says that gap is fixed. The point for buyers remains: a logo on the box is not a substitute for knowing who built the firmware and what they can push later.

What to do about it

Inventory Android-based devices on corporate, clinic and OT-adjacent networks: set-top boxes, signage, kiosks, projectors, conference room players.
Compare models against Synthient’s public list, remembering a model name alone does not prove infection.
Segment IoT and signage away from engineering workstations and control networks.
Don’t lean on IP reputation alone for remote access. Add MFA, device posture and behavioral signals.
Require certified firmware and security attestations from suppliers of Android-based equipment.
If a box is affected, replace or disconnect it. An uninstall won’t cut it when the stub lives in firmware.

Bottom line

The attacker didn’t break in. The manufacturer put the backdoor in the box and sold the keys.
More than 1.3 million devices are cut off from their operators for now. The malware is still on the boxes.
Treat every cheap Android device near OT the way you’d treat an untrusted gateway: inventory it, segment it, or get it off the floor.

Stay sharp out there.

Javier