由私营安全公司组成的联盟与日本国家警察厅合作，破坏了 XCPE 后门程序，该后门被用于构建一个覆盖 200 多个国家、包含 130 多万台 Android 设备的大型僵尸网络。Google、Lumen、Human Security、Plume、Synthient 和 TrendAI 参与了此次破坏行动。Google 威胁情报小组（GTIG）在周一的博客中表示：“我们高度确信，该后门和僵尸网络是由 Videostrong Technology（视强科技）为牟取经济利益而故意开发、部署和运营的。”
A coalition of private-sector security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption. “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the Google Threat Intelligence Group (GTIG) said in a Monday blog.
Videostrong Technology 是一家总部位于中国深圳的硬件制造商，生产包括家用电视盒和投影仪在内的 Android 设备。据 Google 称，Videostrong 故意在设备固件中植入 XCPE 后门，并将访问权限出售给犯罪关联方，使他们能够在发货给不知情客户的设备上安装额外的恶意软件模块。当买家将这些设备连接到家庭网络时，预装的后门允许操作者创建代理网络，并利用客户的互联网连接隐藏恶意流量，而客户对此毫不知情。
Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers.
据 TrendAI 称，固件预装的管理代理伪装成标准的远程管理客户端。它从一个 GitHub 页面拉取更新，并连接到一个消息队列遥测传输（MQTT）服务器，使操作者能够完全远程控制每台盒子，从而安装和移除应用、更改设置、向受感染设备推送更新。在 6 月 3 日至 10 月 1 日期间，TrendAI 记录了 380 多万个不同的家庭和移动 IP 地址连接到该行动。该联盟还破坏了用于管理关联模块的命令与控制域名。
When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge. The firmware’s pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation.
“由于这些附属机构拥有超出 XCPE 的多元化模块分销渠道，我们评估，摧毁其 C2 域名将切断至少 1000 万台额外受感染设备的访问，”GTIG 表示。Google 称，其已与 Videostrong 切断关系，并禁止该 OEM 生产预装 Google 应用的设备。Videostrong 未立即回应 The 的询问。这一后门和僵尸网络行动属于与 BadBox 2.0 相同的生态系统，BadBox 2.0 是另一个臭名昭著的僵尸网络，在 2025 年 3 月被 Human、Google 和 TrendAI 摧毁前，已感染超过 1000 万台电视盒及其他设备。®
The coalition also disrupted the command-and-control domains used to manage the affiliate modules. “Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices,” according to GTIG. Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps. Videostrong did not immediately respond to The’s inquiries. This backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another notorious botnet that infected more than 10 million TV boxes and other devices before Human, Google, and TrendAI disrupted it in March 2025.®