Threat Intel·General CTI·Nov 3, 2026·ByBulwark Sierra

XCPE Firmware Backdoor: Recover Device Trust Beyond the Botnet Takedown

Google's XCPE investigation describes persistent firmware backdoors in set-top boxes. Inventory suspect devices, isolate exposure and verify recovery rather than equating a takedown with cleanup.

Conceptual illustration of a pale gatehouse with an open wooden door on a stone causeway beside water, with winding paths in mist and a crimson ribbon.

Google has disclosed a firmware-level backdoor campaign that it says enrolled more than 1.3 million set-top boxes in the XCPE botnet. For small businesses and government contractors, the immediate question is not simply whether the botnet's command servers were disrupted. It is whether a purchased device on an office or home-working network can still be trusted.

In its November 2 report, Google Threat Intelligence Group says it and industry partners dismantled the backdoor's infrastructure the previous week. The report describes malware evolving since at least late 2024; November 2 is the reporting date, not the beginning of the infections. Google assesses with high confidence that manufacturer Videostrong Technology Co. intentionally developed, deployed and operated the backdoor for financial gain. That attribution is Google's assessment.

What the investigation found

Google describes a system-privileged firmware component, named x.cpe or com.oemservice in different builds, that communicates with command infrastructure and supports additional malware. Its documented capabilities include silent application installation, remote shell commands, screen capture and network reconnaissance. Affiliate modules turned infected devices into residential proxy nodes or generated fraudulent advertising activity.

The persistence matters: Google says an uninstalled x.cpe package can be reinstalled from the device's OEM partition at reboot. Removing a visible app is therefore not a reliable recovery test. The report also describes evolving loaders and additional system-partition installation techniques, rather than one static application that every operator can remove in the same way.

Who should check exposure

The reported population is predominantly Android TV set-top boxes, but Google also observed other Android-based IoT equipment, including digital signage, karaoke machines and telehealth devices. The report does not provide a complete affected-model inventory or a universal fixed firmware release. This is not evidence that every Android device, every TV box or every product from a particular retail brand is infected.

Google says it banned Videostrong and future subsidiaries or affiliates from producing certified Android devices or supplying software to other certified vendors, and changed its review process. That enforcement does not establish that already-deployed equipment has been cleaned. Google's separate estimate that affiliate infrastructure disruption could sever access to at least 10 million additional compromised devices is also not an XCPE enrollment count or proof of endpoint remediation.

Actions for a lean security team

Find the devices behind the displays. Inventory TV boxes, signage players and similar Android equipment in reception areas, meeting rooms and approved home-working setups. Record model, firmware, seller, network segment and business owner. A familiar retail badge does not by itself establish the underlying manufacturer's provenance.
Isolate suspected equipment before testing recovery. Remove its access to business networks and sensitive services while preserving relevant device details and network logs. Where practical, replace its business function with a known-trustworthy device rather than reconnecting it to see whether suspicious traffic returns.
Require a defensible trust-restoration path. Ask the responsible supplier for model-specific findings and an authenticated recovery image or replacement process. Do not assume app removal, rebooting or a factory reset removes a firmware preload. If trustworthy recovery cannot be demonstrated, replacement is the safer operational choice.
Scope what the device could reach. Review segmentation, outbound activity and any accounts used on suspected equipment. If credentials may have been exposed, revoke sessions and replace those credentials from a trusted system. A proxy-capable device is a reason to investigate, not automatic proof that neighboring machines were compromised.
Separate disruption monitoring from closure. Use the original report's technical findings and indicator context to guide hunting. Quiet command infrastructure after a takedown does not prove clean firmware. Keep the recovery decision tied to device provenance and validated remediation.

Bulwark assessment

This is a procurement and recovery problem as much as a malware-detection problem. Low-cost equipment can quietly become part of an organization's network trust boundary even when it was purchased only to play video. Network isolation limits the damage a questionable device can do; supplier assurance and a tested replacement process determine whether that device should return.

For government contractors, keep such equipment away from systems handling sensitive contract information and document the actual exposure assessment. The research does not establish compromise of any particular contractor or loss of controlled information. If an incident is found, evaluate applicable contractual reporting requirements with the responsible security and legal personnel rather than assuming a botnet headline establishes a notification duty.

The main evidence limitation is the lack of a complete model-by-model remediation matrix in the reviewed report. Google's attribution, population estimates and disruption claims should remain attributed. None substitutes for checking the equipment in your own environment.

Original source

Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet — November 2, 2026. Includes the technical analysis and source-authored indicator tables; validate indicators and their context before operational use.

Extracted Observables

245 observables, auto-extracted and defanged.

Analysis artifacts

TXT CSV JSON YARA

Choose a file to view it here. Values are live, not defanged.

IPv4 (4)

219[.]134[.]163[.]210219[.]134[.]163[.]21123[.]94[.]49[.]5738[.]145[.]197[.]135

Domains (158)

absolut[.]fitalpivara[.]comalptk[.]comamhib[.]comanalysis[.]shixunsuda[.]comanyevonline[.]comauqee[.]combd-devmetrics[.]netbeepityping[.]combeezlepongmad[.]combestipip[.]combkdomain[.]cnbloopondle[.]comblustpong[.]combraigwshat[.]combrisping[.]combronglepong[.]comclapslpist[.]comclapslport[.]comcloudbrokerapi[.]xyzcollection[.]shixunsuda[.]comcolumbus2024[.]comcom[.]abc[.]nexuscom[.]abc[.]nexus[.]datacom[.]abc[.]nexus[.]service[.]sncraipivolta[.]comcreapslpinut[.]comcrodipolis[.]comdddlink[.]linkdelpiverno[.]comdepomancy[.]comdewswyra[.]comdgjm[.]onlinedisview[.]comdmurdce[.]xyzdrackpingcare[.]comdramapi[.]comdrapithon[.]comdrgdj[.]topearn[.]fmedisajalsjfdfh[.]shopfawsilver[.]comfawsindra[.]comfecebbbk[.]xyzfilemail[.]comfizzlepong[.]comflaigwern[.]comflapilo[.]comflapslwstorm[.]comflawsino[.]comflewsnark[.]comfloporin[.]comfloppipple[.]comflumpipoodle[.]comfrosping[.]comfshuaons2[.]onlinefuioahsdoa3[.]storefuisans1[.]onlinegapslpinch[.]comgapslwsbor[.]comgeo-loadbalanced[.]comglapoton[.]comglewsnap[.]comglippinger[.]comgloobfnatch[.]comgloopong[.]comglowspar[.]comgrasplpond[.]comgrinapslpocal[.]comgtxvdqvuweqs[.]comguangzhouroot[.]comhaimnsgsjhansj[.]shophawsith[.]comhiddeninplainsight[.]topintermedia-arts[.]tvip-api[.]comishano456[.]sbsishuoabh3years[.]onlinejaguar-distributor[.]logreporter[.]comjaguar-distributor[.]syslogcollector[.]comlapslponze[.]comleisurepuz[.]comlepovia[.]comlimpingcare[.]comlinkfog[.]cnlorapslpifyx[.]comlowswyn[.]comlunapiris[.]commcstb[.]anyevonline[.]commfiny[.]commopith[.]commqtt[.]szbboys[.]commudponger[.]comnepiral[.]comopostra[.]comott[.]szbboys[.]compibberflop[.]compikaroodle[.]comploponix[.]comprataw[.]comqepoth[.]comrapinel[.]comrapslpine[.]comrapslponic[.]comrapslwsweave[.]comraspongle[.]comripotus[.]comrowswyn[.]comscapslwshell[.]comsdoisanadf[.]shopshaiosjdaln[.]shopshsuanalsjai[.]shopsmrtai[.]ccsnarpong[.]comsnorpdoodle[.]comsofpilan[.]comsoporth[.]comspiritlib[.]cyouspopel[.]comszbboys[.]comtawserin[.]comtawswizzle[.]comteowsmera[.]comtepiol[.]comtewsmariel[.]comthaiporix[.]comthapolex[.]comtorpoodle[.]comtrapslwsin[.]comtrawsica[.]comtripikazu[.]comtwindping[.]comtx-devmetrics[.]netty4523[.]spacety54fgd435[.]myue886578433[.]onlinevaiporun[.]comvespilara[.]comvorpolis[.]comvrr8345[.]sitewhispong[.]comwinklenark[.]comwizzleplonk[.]comwogglenift[.]comxmsae[.]sbsxshaon123[.]sbsyapodust[.]comyewsara[.]comyokatvonline[.]comzarflonk[.]comzenapslpinic[.]comzerapslpomat[.]comzimpire[.]comzingpingbees[.]comzippypongbee[.]comzoraipinex[.]comzorapslwsnic[.]comzrawsomble[.]com

URLs (2)

hxxp://mcstb[.]anyevonline[.]com:8000hxxp://ott[.]szbboys[.]com:8000/cpe/file/upload

md5 (3)

96146abb8c2a75dab8cc1bb46c323923abd0b6de6fdf78234f5dab098d5dd229d8971688d1929b6ed915b80eca7e7e3f

sha256 (78)

0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af901b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae6202b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c004ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d2207b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f10d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea86908670ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc6017d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a8941806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a41c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c531c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd631c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d2001f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b96020af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd22cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f331d3a1cf85656c3657e97bab6f15b6e4ce30bf319069b22e8356dccac230321350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af43627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd97853768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e1839792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d4359223e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f94f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d04fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d56126f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291701f57169f3968bf412d33ec09fa6f2c11ece632aed9f44efa38eaf4fa2e08c671f52519aae77fb20448ea065caa55750bcd73cf425aab203277032e260a1981742b7ad8b95d4e0784c914f2b84706124f5a86a404e0fd479a0a97a784c2bb9e76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b27830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb427eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c819483b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea308953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee8cb62b3a9b74ca8b907aef7d83fee65f3ab80e0f4acbf4b2415ea1c2a6caf7969216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f292326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c7517699874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa89df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8ea552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7a63757715b35ddd99916b63a1354de1ec05ac5855a480fe9a547b002e2091dcba6c7ef9b6d5277dada145361164ff79e1e6c6be1cd28f6739113c72ee30ea4ccb2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691bbcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97deddc0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fad4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0e2bfca7225af84f116de7ed10e4ad425d0ebfd6e19903d226b9768282865700febcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528edf2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2af451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2ff96f093bbac32654db62ebb33276c64cd30eb25a0bc11e66608ca40efb1bbdc

These observational values were auto-extracted from this report and are not a blocklist or a maliciousness verdict. Values shown are defanged for safe viewing. Downloads may contain live values. A YARA artifact is available; review its header to establish its origin and requirements. Review the source context before use.