Videostrong Preinstalled x.cpe Backdoor in 206 Android TV Models for Proxy and Ad Fraud Operations
A factory-installed backdoor in Videostrong Android TV boxes enabled large-scale residential proxy and ad-fraud operations until Google-led legal and technical action seized its C2 infrastructure. The incident reveals a multi-year supply-chain compromise affecting consumer devices whose firmware cannot be cleaned by owners. Replacement or coordinated vendor patches remain the only remediation path.
Plume and Synthient data indicate that 182 model strings are now flagged; owners must verify serials against published lists and treat any device lacking a current security update path as permanently compromised. Future enforcement will require certification bodies to audit firmware signing keys rather than relying on post-market detection.
Synthient: Residential proxy traffic volume from the remaining x.cpe devices will migrate to new infrastructure at a rate exceeding 25 percent within 45 days.
Sources (2)
- [1]Google Threat Analysis Group(https://blog.google/threat-analysis-group/disrupting-videostrong-botnet/)
- [2]TrendAI x.cpe Analysis(https://www.trendmicro.com/en_us/research/26/k/x-cpe-backdoor-analysis.html)