<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8" -->

---
title: Shutting the Door on the XCPE Botnet | daily.dev
description: Google and industry partners dismantled the XCPE backdoor, which had enrolled more than 1.3 million Android set-top boxes into a botnet. Google assesses with...
canonical: https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Shutting the Door on the XCPE Botnet | daily.dev
og:description: Google and industry partners dismantled the XCPE backdoor, which had enrolled more than 1.3 million Android set-top boxes into a botnet. Google assesses with...
og:url: https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8
og:image: https://api.daily.dev/og/posts/cnKXK1dj8.png
og:image:alt: Shutting the Door on the XCPE Botnet
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Shutting the Door on the XCPE Botnet

**[Google Cloud](https://daily.dev/sources/gcp)** · 24 min read · 0 upvotes · 0 comments

## Summary

Google and industry partners dismantled the XCPE backdoor, which had enrolled more than 1.3 million Android set-top boxes into a botnet. Google assesses with high confidence that Videostrong Technology Co., an Android OEM/ODM, intentionally built and operated the backdoor for profit, selling access to criminal affiliates running ad-fraud and residential proxy modules. Disrupting the affiliates' C2 domains is expected to sever access to at least 10 million additional compromised devices. The malware used a modular three-stage architecture (x.cpe, com.abc.nexus, and downloaded modules) communicating over MQTT, and Google has banned Videostrong from building certified Android devices.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet>

## Questions this post answers

### What is the XCPE botnet and who built it?

XCPE is an Android backdoor and botnet that enrolled more than 1.3 million set-top boxes, built intentionally by Videostrong Technology Co., an Android OEM/ODM, for financial gain. Videostrong sold backdoor access to criminal affiliates who loaded ad-fraud and residential proxy modules onto infected devices, and Google has since banned Videostrong from making certified Android devices.

_Developers tracking Android supply chain threats can follow disruption writeups like this one on daily.dev._

### How did the XCPE malware disable Google Play Protect to install modules silently?

The x.cpe backdoor calls a function, disablePackageVerify(), that sets the global setting 'package_verifier_user_consent' to -1 via Settings.Global.putInt, which disables Google Play Protect's app verification. This lets the malware silently download and execute additional APKs and modules without triggering security scans or user consent prompts.

_Anyone auditing Android firmware for tampering can use details like this to spot similar evasion tricks, via daily.dev._

### What communication protocol does the XCPE botnet use for command and control?

The botnet uses a two-stage C2 process: an initial HTTP POST request fetches dynamic configuration, geolocation data, and STUN server parameters, then the device establishes a persistent MQTT connection to receive instructions. Commands sent over MQTT include silent app installs, arbitrary shell execution, screen capture, and network reconnaissance, all routed through a single broker, mqtt.szbboys[.]com.

_Engineers researching IoT botnet C2 patterns can dig into MQTT-based malware behavior like this via daily.dev._

## Similar posts on daily.dev

- [Google’s Continued Disruption of Malicious Residential Proxy Networks](https://daily.dev/posts/google-s-continued-disruption-of-malicious-residential-proxy-networks-6zdypafgl) · Google Cloud · 1 upvotes · 0 comments
- [Kimwolf v7: An Evolution of the Kimwolf Botnet](https://daily.dev/posts/kimwolf-v7-an-evolution-of-the-kimwolf-botnet-qyisegkoc) · Unit 42 · 0 upvotes · 0 comments
- [Google and FBI Dismantle NetNut Residential Proxy Botnet](https://daily.dev/posts/google-and-fbi-dismantle-netnut-residential-proxy-botnet-iusqk4knt) · Latest Hacking News · 8 upvotes · 1 comments
- [Is Your Android TV Streaming Box Part of a Botnet? – Krebs on Security](https://daily.dev/posts/is-your-android-tv-streaming-box-part-of-a-botnet-krebs-on-security-kajzwi9lv) · Krebs on Security · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#android](https://daily.dev/tags/android), [#backend](https://daily.dev/tags/backend), [#malware](https://daily.dev/tags/malware)

[View this post on daily.dev](https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Shutting the Door on the XCPE Botnet","url":"https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8"},"datePublished":"2026-11-02T13:03:54.120Z","dateModified":"2026-11-03T14:03:44.045Z","description":"Google and industry partners dismantled the XCPE backdoor, which had enrolled more than 1.3 million Android set-top boxes into a botnet. Google assesses with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,android,backend,malware","timeRequired":"PT24M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"Shutting the Door on the XCPE Botnet"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/shutting-the-door-on-the-xcpe-botnet-cnkxk1dj8#faq","mainEntity":[{"@type":"Question","name":"What is the XCPE botnet and who built it?","acceptedAnswer":{"@type":"Answer","text":"XCPE is an Android backdoor and botnet that enrolled more than 1.3 million set-top boxes, built intentionally by Videostrong Technology Co., an Android OEM/ODM, for financial gain. Videostrong sold backdoor access to criminal affiliates who loaded ad-fraud and residential proxy modules onto infected devices, and Google has since banned Videostrong from making certified Android devices. Developers tracking Android supply chain threats can follow disruption writeups like this one on daily.dev."}},{"@type":"Question","name":"How did the XCPE malware disable Google Play Protect to install modules silently?","acceptedAnswer":{"@type":"Answer","text":"The x.cpe backdoor calls a function, disablePackageVerify(), that sets the global setting 'package_verifier_user_consent' to -1 via Settings.Global.putInt, which disables Google Play Protect's app verification. This lets the malware silently download and execute additional APKs and modules without triggering security scans or user consent prompts. Anyone auditing Android firmware for tampering can use details like this to spot similar evasion tricks, via daily.dev."}},{"@type":"Question","name":"What communication protocol does the XCPE botnet use for command and control?","acceptedAnswer":{"@type":"Answer","text":"The botnet uses a two-stage C2 process: an initial HTTP POST request fetches dynamic configuration, geolocation data, and STUN server parameters, then the device establishes a persistent MQTT connection to receive instructions. Commands sent over MQTT include silent app installs, arbitrary shell execution, screen capture, and network reconnaissance, all routed through a single broker, mqtt.szbboys[.]com. Engineers researching IoT botnet C2 patterns can dig into MQTT-based malware behavior like this via daily.dev."}}]}
```