What Google found. The backdoor, x.cpe, ships preloaded in the firmware with system-level privileges. If a user uninstalls it, it reinstalls itself from the /oem/ partition on reboot. It talks to Videostrong's command servers and hands off to a loader that installs the paying affiliates' modules. Help Net Security reports operators could also take live screenshots, inject keystrokes and open a shell on the box.
What the boxes were sold for. Mostly residential proxies. Google names modules tied to proxy and bandwidth-sharing services including Linkfog, AppSalt (Honeygain), NetNut, GaGaNode and Traffmonetizer, which routed strangers' internet traffic through people's home connections without their knowledge. Other modules faked ad views. Synthient, which traced the operation with the MPA, ties it to the MECOOL brand of boxes sold since early 2020.
What Google did. Legal action to take down Videostrong's control domains and servers, and the C2 domains of more than a dozen malware families loaded through the backdoor. It also banned Videostrong and any future affiliates from building certified Android devices or supplying software to certified vendors. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI took part. The backdoor is still on the devices, though, so only clean firmware or unplugging them removes it.
Why this matters to an enterprise. A residential proxy makes an attacker's login attempt look like it's coming from someone's living room, which is exactly the traffic that IP reputation and geo-blocking let through. If your fraud or identity team treats "home ISP address" as low risk, botnets like this are why that rule leaks. Two things worth doing this week: check whether sign-in and password-spray alerts weight residential IPs as trusted, and look for unknown Android TV boxes on guest, retail or branch networks, since each one is someone else's exit node.