> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Videostrong OEM backdoor dismantled after compromising 1.3M set-top boxes - URL: https://f4n6.co.uk/security-feed/videostrong-oem-backdoor-dismantled-after-compromising-1-3m-set-top-boxes/ - Published: 2026-11-02T14:47:01.000Z - Updated: 2026-11-02T14:47:01.000Z - Author: Jeff Davies - Tags: #security-feed, Videostrong Technology Co. ## 1\. Executive summary Google and industry partners dismantled the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet, and Google states high confidence that Videostrong Technology Co., an Android OEM and ODM, developed and operated it for financial gain. The backdoor was preloaded in firmware at the android.uid.system privilege level and monetised by selling access to criminal affiliates whose modules ran ad-fraud, enrolled devices as residential proxy exit nodes, and loaded further malware. No CVE is associated with this item and no CISA KEV entry applies; the exposure is a supply-chain compromise of consumer and IoT hardware, not an exploitable software flaw. EMEA financial services risk is indirect: infected Android TV and digital signage devices on corporate or staff networks can be used as proxy exit nodes and to route malicious traffic, and any Videostrong-branded or white-label hardware in a client estate should be treated as untrusted. Google's attribution to Videostrong is single-sourced to Google Threat Intelligence and the actor has no MITRE ATT&CK profile, so the attribution is unconfirmed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | Devices were compromised at the manufacturer through preloaded firmware, a third-party hardware supply-chain exposure rather than a flaw in software the client runs | Clients must establish whether Videostrong-built or white-label devices sit in their estate or supplier chain and record the manufacturer as an ICT third-party dependency | | NIS2 Art. 21(2)(d): supply chain security measures | The compromise originated in OEM firmware supplied through downstream brands, resellers and distributors | Entities in scope must assess hardware supply-chain security for procured connected devices and set requirements on suppliers | ## 3\. Technical analysis & attack chain Google Threat Intelligence Group reports that the XCPE backdoor was built into firmware across many device models and brands over multiple years. The infection chain, as described by Google: 1. A stub package (x.cpe in some builds, com.oemservice in others) is preloaded in the system partition of the firmware and runs at the android.uid.system privilege level. 2. On boot the stub checks the device's oem/ directory for the corresponding x.cpe package and installs it into /data/app/. If a user uninstalls x.cpe from /data/app/, the BootReceiver reinstalls it from /oem/ on the next reboot. 3. x.cpe exports two ContentProviders holding configuration tables (runtime parameters, device identifiers, proxy configuration blobs, execution flags) that co-installed apps such as Videostrong's YokaTV Player can read. 4. The malware derives its HTTP bootstrap C2 by querying content://com.release.debug.provider/configs for private\_url via x.cpe.util.ExtraReadUtils, then checks the system property ro.mecool.device. If true it uses http://mcstb.anyevonline.com:8000; if false it builds http://stb\[AndroidVersion\]\[Type\].anyevonline.com:8000. 5. It POSTs an AES-encrypted JSON object containing hardware telemetry (serial number, MAC, model, firmware version) to /router/config/mqtt, /router/config/acs and /router/config/app. The mqtt endpoint returns broker hostname, TCP port, authentication tokens and the topic structure /device/{model}/{chipId}/{action}. The acs endpoint returns ip-api\[.\]com and a Google STUN server for geolocation and NAT traversal, a file upload URL at http://ott.szbboys\[.\]com:8000/cpe/file/upload, and ad-module flags (adBwmActive, adDevourUse, adDevourCode). The app endpoint returns module-level configs passed to a SQLite ContentProvider named ShareProvider (com.oem.share.provider). 6. Persistent C2 runs over MQTT via x.cpe.mqtt.MqttUtils. All samples analysed use the single broker mqtt.szbboys\[.\]com, resolved by 219.134.163\[.\]210 and 219.134.163\[.\]211 on non-standard ports 3885-3887. 7. MQTT topics map to actions: silent APK installation; disabling Google Play Protect by setting the global setting package\_verifier\_user\_consent to -1 through Settings.Global.putInt in AppUtils.disablePackageVerify(); arbitrary shell execution via sh under the system UID with results published back to the broker; shell script execution via x.cpe.util.RunCmds; screen capture using android.app.Instrumentation.sendKeyDownUpSync() and Java reflection on android.view.SurfaceControl.screenshot and SurfaceControl$ScreenshotHardwareBuffer, compressed to JPEG and published over MQTT; and network reconnaissance through libtraceroute.so, ping tests and AS-lookup WHOIS queries. Module execution is offloaded to a separate loader, com.abc.nexus, which x.cpe drives over IPC. com.abc.nexus.broadcast.BootReceiver broadcasts the com.abc.nexus.data intent, bootstrapping com.abc.nexus.service.CoreService, which sets up a RemoteMessageHandler listener and parses JSON payloads from x.cpe. Many builds of com.abc.nexus extract libseccomp\_guard.so before module initialisation; it filters system calls to block pausing or terminating threads, denies cross-process interference and prevents child-process spawning. Since August 2026 new dropper packages have been pushed over MQTT, apparently synchronised with a mass uninstallation of com.abc.nexus; they are disguised as system apps (com.android.system.ntp, com.android.sso.auth.handler) and some extract libexploit.so, which runs nativeAdbRoot() and nativeAdbShell() to restart adbd as root, remount the system partition read-write, replicate into /system/priv-app/ and write /system/etc/permissions/privapp-permissions-.xml granting android.permission.INSTALL\_PACKAGES and android.permission.REBOOT. Operators control these packages through shell scripts pushed via the broker that set persist.networkstack.uninstall, persist.networkstack.skip\_system\_install and persist.networkstack.install\_time (timestomping). Monetisation modules are native ELF daemons, SDKs compiled into the com.abc.nexus DEX, or secondary APKs fetched from staging. Google names Linkfog (Go binary lw\_android\_agent, FRP reverse tunnels, PCDN proxy), Jaguar (libjaguar.so, ChaCha20 key derivation via ARM NEON, TCP and UDP relay), AppSalt/Honeygain (optIn() called without a consent screen, WebSocket C2, UDP/QUIC proxy gateways), BWM/IPWeb, GaGaNode/IPCola, NetNut/Popanet, Traffmonetizer, EarnFM Fleet (libfleetshare.so), Spirit, Moyu, Bird, Fission (headless ad fraud firing pvm and pvtpm impression beacons) and HiddenView (com.ota.service, transparent overlay, hidden WebViews). Configuration arrives as an ext/lib/config MQTT message carrying resource constraints (for example cpu 70, memory 50, ioRead 5000, ioWrite 5000), per-architecture download addresses and MD5 hashes, and a policys status list enabling or disabling modules by libCode. Devices are assigned to one of six timezone-separated server pools on ott.szbboys\[.\]com. A significant majority of staged files are hosted as GitHub releases on operator-owned pages; others sit on filemail\[.\]com and on 38.145.197\[.\]135 and 23.94.49\[.\]57. Google observed operators capturing live screenshots, injecting keystrokes, exfiltrating account information, device information, package inventories and system logs, and running shell commands including reverse shells. The botnet is globally dispersed. Most infected devices are Android TV set-top boxes, with some telehealth devices, karaoke machines and digital signage devices also observed. Confidence caveats. The entire technical account is single-sourced to Google Threat Intelligence Group; no independent technical report was available for this advisory. Google's attribution of development and operation to Videostrong is stated at high confidence by Google alone, and Videostrong has no MITRE ATT&CK profile, so the attribution is unconfirmed. Google's assessment that affiliate C2 takedowns severed access to at least 10 million additional devices is Google's own estimate and is not independently corroborated. No affected or fixed firmware versions are named in public reporting, and no CVE has been assigned. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Inventory Android TV set-top boxes, digital signage and other Android IoT devices on corporate networks and in supplier-provided equipment; identify any Videostrong-built or white-label units. Google's Android TV partner list is the reference for certified brands. - Block egress to mqtt.szbboys\[.\]com, \*.anyevonline\[.\]com, ott.szbboys\[.\]com, szbboys\[.\]com, intermedia-arts\[.\]tv and yokatvonline\[.\]com at the DNS and firewall layers, and block outbound TCP 3885-3887 except where explicitly required. - Hunt proxy and C2 traffic to the domains and IPs in §5, and check for the packages x.cpe, com.oemservice, com.abc.nexus, com.android.system.ntp, com.android.sso.auth.handler, com.ota.service and com.newtv.cboxtv on managed Android devices. - On any confirmed infected device, remove it from the network. Google states x.cpe cannot be removed by the user and reinstalls from /oem/ on reboot, so reflash or replace the device; do not rely on uninstalling the package. ### P2 (within 72 hours) - Verify Google Play Protect is active on Android devices and check the global setting package\_verifier\_user\_consent has not been set to -1. - Review network logs for MQTT sessions to non-standard ports and for devices acting as proxy exit nodes (unexpected inbound relay traffic, UDP/QUIC to proxy gateways). - Where infected devices handled account or session data, review for credential exposure given Google's observation of account-information exfiltration. ### P3 (within 7 days) - Add OEM firmware provenance to hardware procurement requirements and require independent security audits from ODMs, as Google recommends. - Delist or quarantine Videostrong-branded hardware from approved-supplier lists and check white-label resellers for the same firmware. - No fixed firmware release is named in public reporting; track Google's Android TV partner list and vendor advisories for remediation. ## 5\. Indicators of compromise | type | value | confidence | source | | ------ | ---------------------------------------------------------------- | ---------- | ----------------- | | domain | mqtt\[.\]szbboys\[.\]com | high | Google Cloud Blog | | domain | ott\[.\]szbboys\[.\]com | high | Google Cloud Blog | | domain | szbboys\[.\]com | high | Google Cloud Blog | | domain | intermedia-arts\[.\]tv | medium | Google Cloud Blog | | domain | yokatvonline\[.\]com | medium | Google Cloud Blog | | ipv4 | 219\[.\]134\[.\]163\[.\]210 | high | Google Cloud Blog | | ipv4 | 219\[.\]134\[.\]163\[.\]211 | high | Google Cloud Blog | | ipv4 | 23\[.\]94\[.\]49\[.\]57 | high | Google Cloud Blog | | ipv4 | 38\[.\]145\[.\]197\[.\]135 | high | Google Cloud Blog | | sha256 | 3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18 | high | Google Cloud Blog | | sha256 | 4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0 | high | Google Cloud Blog | | sha256 | 8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c8194 | high | Google Cloud Blog | | sha256 | 92326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c75176 | high | Google Cloud Blog | | sha256 | 17d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a894 | high | Google Cloud Blog | | sha256 | 76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b2 | high | Google Cloud Blog | | sha256 | 05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d22 | high | Google Cloud Blog | | sha256 | da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104 | high | Google Cloud Blog | | sha256 | 471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc | high | Google Cloud Blog | | sha256 | 39792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d435922 | high | Google Cloud Blog | | sha256 | 2cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b | high | Google Cloud Blog | | sha256 | dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99 | high | Google Cloud Blog | | sha256 | 20af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d | high | Google Cloud Blog | | sha256 | f451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4 | high | Google Cloud Blog | | sha256 | 0d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea8690867 | high | Google Cloud Blog | | sha256 | 22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd2 | high | Google Cloud Blog | | sha256 | 6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d5612 | high | Google Cloud Blog | | sha256 | 049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c0 | high | Google Cloud Blog | | sha256 | bcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230 | high | Google Cloud Blog | | sha256 | 1806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a4 | high | Google Cloud Blog | | sha256 | 9216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f2 | high | Google Cloud Blog | | sha256 | 04ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c | high | Google Cloud Blog | | sha256 | 3e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6 | high | Google Cloud Blog | | sha256 | 415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b | high | Google Cloud Blog | | sha256 | 9df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb | high | Google Cloud Blog | | sha256 | be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97dedd | high | Google Cloud Blog | | sha256 | 8953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee | high | Google Cloud Blog | | sha256 | 01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde | high | Google Cloud Blog | | sha256 | 5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a | high | Google Cloud Blog | | sha256 | 085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d | high | Google Cloud Blog | | sha256 | 07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179 | high | Google Cloud Blog | | sha256 | 02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62 | high | Google Cloud Blog | | sha256 | 6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291 | high | Google Cloud Blog | | sha256 | 1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200 | high | Google Cloud Blog | | sha256 | 486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa | high | Google Cloud Blog | | sha256 | 350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4 | high | Google Cloud Blog | | sha256 | 2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed | high | Google Cloud Blog | | sha256 | 99874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa8 | high | Google Cloud Blog | | sha256 | 4fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd | high | Google Cloud Blog | | sha256 | cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4 | high | Google Cloud Blog | | sha256 | 3627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd9785 | high | Google Cloud Blog | | sha256 | 0ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc60 | high | Google Cloud Blog | | sha256 | 1c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd63 | high | Google Cloud Blog | | sha256 | 1c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c53 | high | Google Cloud Blog | | sha256 | 1c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd | high | Google Cloud Blog | | sha256 | 498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f9 | high | Google Cloud Blog | | sha256 | b2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0 | high | Google Cloud Blog | | sha256 | 1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960 | high | Google Cloud Blog | | sha256 | a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7 | high | Google Cloud Blog | | sha256 | 3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f | high | Google Cloud Blog | | sha256 | c0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5 | high | Google Cloud Blog | | sha256 | 0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9 | high | Google Cloud Blog | | sha256 | 83b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea30 | high | Google Cloud Blog | | sha256 | 02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3 | high | Google Cloud Blog | | sha256 | 69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb | high | Google Cloud Blog | | sha256 | 7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d | high | Google Cloud Blog | | sha256 | d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4 | high | Google Cloud Blog | | sha256 | e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0 | high | Google Cloud Blog | | sha256 | cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903 | high | Google Cloud Blog | | sha256 | 08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f1 | high | Google Cloud Blog | | sha256 | fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2 | high | Google Cloud Blog | | sha256 | b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b | high | Google Cloud Blog | | sha256 | ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed | high | Google Cloud Blog | | sha256 | 42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135 | high | Google Cloud Blog | | sha256 | 7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42 | high | Google Cloud Blog | | sha256 | 331d3a1cf85656c3657e97bab6f15b6e4ce30bf319069b22e8356dccac230321 | high | Google Cloud Blog | | sha256 | d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fa | high | Google Cloud Blog | | sha256 | e2bfca7225af84f116de7ed10e4ad425d0ebfd6e19903d226b9768282865700f | high | Google Cloud Blog | | sha256 | d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5 | high | Google Cloud Blog | | md5 | 96146abb8c2a75dab8cc1bb46c323923 | high | Google Cloud Blog | | sha256 | f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a | high | Google Cloud Blog | | sha256 | 8cb62b3a9b74ca8b907aef7d83fee65f3ab80e0f4acbf4b2415ea1c2a6caf796 | high | Google Cloud Blog | | sha256 | a63757715b35ddd99916b63a1354de1ec05ac5855a480fe9a547b002e2091dcb | high | Google Cloud Blog | | sha256 | 701f57169f3968bf412d33ec09fa6f2c11ece632aed9f44efa38eaf4fa2e08c6 | high | Google Cloud Blog | | sha256 | 9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8e | high | Google Cloud Blog | | sha256 | 742b7ad8b95d4e0784c914f2b84706124f5a86a404e0fd479a0a97a784c2bb9e | high | Google Cloud Blog | | sha256 | a6c7ef9b6d5277dada145361164ff79e1e6c6be1cd28f6739113c72ee30ea4cc | high | Google Cloud Blog | | sha256 | ff96f093bbac32654db62ebb33276c64cd30eb25a0bc11e66608ca40efb1bbdc | high | Google Cloud Blog | | sha256 | 71f52519aae77fb20448ea065caa55750bcd73cf425aab203277032e260a1981 | high | Google Cloud Blog | | domain | amhib\[.\]com | medium | Google Cloud Blog | | domain | disview\[.\]com | medium | Google Cloud Blog | | domain | prataw\[.\]com | medium | Google Cloud Blog | | domain | auqee\[.\]com | medium | Google Cloud Blog | | domain | alptk\[.\]com | medium | Google Cloud Blog | | domain | mfiny\[.\]com | medium | Google Cloud Blog | | domain | leisurepuz\[.\]com | medium | Google Cloud Blog | | domain | earn\[.\]fm | medium | Google Cloud Blog | | domain | geo-loadbalanced\[.\]com | medium | Google Cloud Blog | | domain | collection\[.\]shixunsuda\[.\]com | medium | Google Cloud Blog | | domain | analysis\[.\]shixunsuda\[.\]com | medium | Google Cloud Blog | | domain | gtxvdqvuweqs\[.\]com | medium | Google Cloud Blog | | domain | hiddeninplainsight\[.\]top | medium | Google Cloud Blog | | domain | bestipip\[.\]com | medium | Google Cloud Blog | | domain | fecebbbk\[.\]xyz | medium | Google Cloud Blog | | domain | guangzhouroot\[.\]com | medium | Google Cloud Blog | | domain | bd-devmetrics\[.\]net | medium | Google Cloud Blog | | domain | jaguar-distributor\[.\]logreporter\[.\]com | medium | Google Cloud Blog | | domain | jaguar-distributor\[.\]syslogcollector\[.\]com | medium | Google Cloud Blog | | domain | tx-devmetrics\[.\]net | medium | Google Cloud Blog | | domain | linkfog\[.\]cn | medium | Google Cloud Blog | | domain | cloudbrokerapi\[.\]xyz | medium | Google Cloud Blog | | domain | dddlink\[.\]link | medium | Google Cloud Blog | | domain | smrtai\[.\]cc | medium | Google Cloud Blog | | domain | bkdomain\[.\]cn | medium | Google Cloud Blog | | domain | columbus2024\[.\]com | medium | Google Cloud Blog | | domain | dmurdce\[.\]xyz | medium | Google Cloud Blog | | domain | edisajalsjfdfh\[.\]shop | medium | Google Cloud Blog | | domain | fshuaons2\[.\]online | medium | Google Cloud Blog | | domain | fuioahsdoa3\[.\]store | medium | Google Cloud Blog | | domain | fuisans1\[.\]online | medium | Google Cloud Blog | | domain | haimnsgsjhansj\[.\]shop | medium | Google Cloud Blog | | domain | ishano456\[.\]sbs | medium | Google Cloud Blog | | domain | ishuoabh3years\[.\]online | medium | Google Cloud Blog | | domain | sdoisanadf\[.\]shop | medium | Google Cloud Blog | | domain | shaiosjdaln\[.\]shop | medium | Google Cloud Blog | | domain | shsuanalsjai\[.\]shop | medium | Google Cloud Blog | | domain | ty4523\[.\]space | medium | Google Cloud Blog | | domain | ty54fgd435\[.\]my | medium | Google Cloud Blog | | domain | ue886578433\[.\]online | medium | Google Cloud Blog | | domain | vrr8345\[.\]site | medium | Google Cloud Blog | | domain | xmsae\[.\]sbs | medium | Google Cloud Blog | | domain | xshaon123\[.\]sbs | medium | Google Cloud Blog | | domain | dgjm\[.\]online | medium | Google Cloud Blog | | domain | drgdj\[.\]top | medium | Google Cloud Blog | | domain | spiritlib\[.\]cyou | medium | Google Cloud Blog | The Honeygain/AppSalt domain set (absolut\[.\]fit through zrawsomble\[.\]com) is listed in the source and is omitted here for length; it is available in the Google Cloud Blog indicator tables. The source's own table labels 96146abb8c2a75dab8cc1bb46c323923 as a DEX hash; it is 32 hex characters and is recorded here as md5. ```iocs domain mqtt[.]szbboys[.]com domain ott[.]szbboys[.]com domain szbboys[.]com domain intermedia-arts[.]tv domain yokatvonline[.]com ipv4 219[.]134[.]163[.]210 ipv4 219[.]134[.]163[.]211 ipv4 23[.]94[.]49[.]57 ipv4 38[.]145[.]197[.]135 sha256 3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18 sha256 4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0 sha256 8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c8194 sha256 92326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c75176 sha256 17d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a894 sha256 76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b2 sha256 05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d22 sha256 da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104 sha256 471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc sha256 39792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d435922 sha256 2cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b sha256 dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99 sha256 20af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d sha256 f451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4 sha256 0d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea8690867 sha256 22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd2 sha256 6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d5612 sha256 049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c0 sha256 bcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230 sha256 1806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a4 sha256 9216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f2 sha256 04ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c sha256 3e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6 sha256 415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b sha256 9df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb sha256 be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97dedd sha256 8953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee sha256 01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde sha256 5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a sha256 085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d sha256 07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179 sha256 02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62 sha256 6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291 sha256 1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200 sha256 486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa sha256 350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4 sha256 2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed sha256 99874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa8 sha256 4fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd sha256 cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4 sha256 3627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd9785 sha256 0ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc60 sha256 1c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd63 sha256 1c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c53 sha256 1c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd sha256 498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f9 sha256 b2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0 sha256 1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960 sha256 a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7 sha256 3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f sha256 c0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5 sha256 0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9 sha256 83b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea30 sha256 02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3 sha256 69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb sha256 7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d sha256 d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4 sha256 e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0 sha256 cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903 sha256 08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f1 sha256 fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2 sha256 b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b sha256 ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed sha256 42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135 sha256 7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42 sha256 331d3a1cf85656c3657e97bab6f15b6e4ce30bf319069b22e8356dccac230321 sha256 d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fa sha256 e2bfca7225af84f116de7ed10e4ad425d0ebfd6e19903d226b9768282865700f sha256 d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5 md5 96146abb8c2a75dab8cc1bb46c323923 sha256 f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a sha256 8cb62b3a9b74ca8b907aef7d83fee65f3ab80e0f4acbf4b2415ea1c2a6caf796 sha256 a63757715b35ddd99916b63a1354de1ec05ac5855a480fe9a547b002e2091dcb sha256 701f57169f3968bf412d33ec09fa6f2c11ece632aed9f44efa38eaf4fa2e08c6 sha256 9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8e sha256 742b7ad8b95d4e0784c914f2b84706124f5a86a404e0fd479a0a97a784c2bb9e sha256 a6c7ef9b6d5277dada145361164ff79e1e6c6be1cd28f6739113c72ee30ea4cc sha256 ff96f093bbac32654db62ebb33276c64cd30eb25a0bc11e66608ca40efb1bbdc sha256 71f52519aae77fb20448ea065caa55750bcd73cf425aab203277032e260a1981 domain amhib[.]com domain disview[.]com domain prataw[.]com domain auqee[.]com domain alptk[.]com domain mfiny[.]com domain leisurepuz[.]com domain earn[.]fm domain geo-loadbalanced[.]com domain collection[.]shixunsuda[.]com domain analysis[.]shixunsuda[.]com domain gtxvdqvuweqs[.]com domain hiddeninplainsight[.]top domain bestipip[.]com domain fecebbbk[.]xyz domain guangzhouroot[.]com domain bd-devmetrics[.]net domain jaguar-distributor[.]logreporter[.]com domain jaguar-distributor[.]syslogcollector[.]com domain tx-devmetrics[.]net domain linkfog[.]cn domain cloudbrokerapi[.]xyz domain dddlink[.]link domain smrtai[.]cc domain bkdomain[.]cn domain columbus2024[.]com domain dmurdce[.]xyz domain edisajalsjfdfh[.]shop domain fshuaons2[.]online domain fuioahsdoa3[.]store domain fuisans1[.]online domain haimnsgsjhansj[.]shop domain ishano456[.]sbs domain ishuoabh3years[.]online domain sdoisanadf[.]shop domain shaiosjdaln[.]shop domain shsuanalsjai[.]shop domain ty4523[.]space domain ty54fgd435[.]my domain ue886578433[.]online domain vrr8345[.]site domain xmsae[.]sbs domain xshaon123[.]sbs domain dgjm[.]online domain drgdj[.]top domain spiritlib[.]cyou ``` Behavioural indicators | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | ---------- | | HTTP POST of AES-encrypted JSON telemetry to /router/config/mqtt, /router/config/acs, /router/config/app on \*.anyevonline\[.\]com port 8000 | proxy and firewall logs | high | | Persistent MQTT sessions to mqtt.szbboys\[.\]com on TCP 3885-3887 | network flow logs | high | | Broker management sessions on ports 8082 (HTTP REST), 8083 (WebSocket) and 18083 (EMQX console) from non-bot IP space | netflow on 219.134.163\[.\]210/.211 | medium | | Global setting package\_verifier\_user\_consent set to -1 | Android device configuration | high | | Packages com.android.system.ntp or com.android.sso.auth.handler present in /system/priv-app/ with a matching privapp-permissions XML in /system/etc/permissions/ | Android device filesystem | high | | System properties persist.networkstack.uninstall, persist.networkstack.skip\_system\_install, persist.networkstack.install\_time set | Android device properties | high | | Outbound UDP/QUIC to proxy gateways and WebSocket C2 from set-top boxes | network flow logs | medium | ## 6\. Detection The source gives distinctive package names, class names, content URIs, system properties and file paths, which support the rules below. No file hash is required for these. ```yara rule XCPE_Backdoor_Android { meta: author = "Adverse Trace" date = "2026-11-02" reference = "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/" description = "Detects XCPE backdoor and com.abc.nexus loader artefacts in Android packages" strings: $pkg1 = "com.oemservice" ascii $pkg2 = "com.abc.nexus" ascii $prov = "com.release.debug.provider/configs" ascii $share = "com.oem.share.provider" ascii $mqtt = "x.cpe.mqtt.MqttUtils" ascii $run = "x.cpe.util.RunCmds" ascii $extra = "x.cpe.util.ExtraReadUtils" ascii $prop = "ro.mecool.device" ascii $host = "anyevonline.com" ascii $broker = "mqtt.szbboys.com" ascii $guard = "libseccomp_guard.so" ascii $exploit = "libexploit.so" ascii $keys = "libnative_keys.so" ascii $topic = "/device/" ascii $cfg = "ext/lib/config" ascii condition: uint32(0) == 0x04034b50 and 3 of them } ``` \`\`\`yaml title: XCPE backdoor MQTT C2 and package activity id: 8f3c2a1e-xcpe-2026 status: experimental author: Adverse Trace date: 2026/11/02 references: ``` - https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/ ``` logsource: category: network\_connection detection: selection\_dns: query|endswith: ``` - '.anyevonline.com' - '.szbboys.com' selection_ip: destination_ip: - '219.134.163.210' - '219.134.163.211' - '23.94.49.57' ``` --- [Read the original source →](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*