From Google Threat Intelligence Group's Nov 2 analysis of the XCPE firmware backdoor:

• HTTP bootstrap: http://mcstb.anyevonline[.]com:8000 on MECOOL devices (system property ro.mecool.device), otherwise http://stb[AndroidVersion][Type].anyevonline[.]com:8000. The device POSTs AES-encrypted hardware telemetry (serial, MAC, model, firmware) to /router/config/mqtt, /router/config/acs and /router/config/app.
• MQTT C2: every sample Google analyzed used mqtt.szbboys[.]com, topics shaped like /device/{model}/{chipId}/{action}.
• Upload endpoint: http://ott.szbboys[.]com:8000/cpe/file/upload.
• Other tells: lookups of ip-api[.]com and a Google STUN server from a TV box right after boot; module files pulled from operator-owned GitHub release pages.
• On the device (if you can get adb access): packages x.cpe, com.oemservice, com.abc.nexus, content providers com.release.debug.provider and com.oem.share.provider, and the global setting package_verifier_user_consent set to -1 (Play Protect verification turned off).

Hunt ideas: search DNS and proxy logs for *.anyevonline.com and *.szbboys.com; flag outbound TCP 1883/8883 (MQTT) or HTTP to port 8000 from IoT or guest VLANs; and look for consumer media devices acting as proxy exit nodes (many unrelated inbound-initiated or long-lived outbound sessions). Because the domains are now seized, a hit tells you a box is infected, not that it is still controlled; the backdoor can be re-pointed, so remove the device rather than just blocking the domains.