🔍 Read the full analysis: From New TV Box To Botnet: Google Disrupts A 1.3-Million-Device Network on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and industry partners disrupted the XCPE botnet in late October, after identifying more than 1.3 million infected set-top boxes. Google attributes the firmware backdoor to device maker Videostrong, but the disruption does not remove it from infected boxes, and the company has not published a court filing.
Google and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to manage more than 1.3 million Android set-top boxes, the company said Nov. 2. Google attributes the backdoor installed in the devices’ firmware to manufacturer Videostrong Technology Co.; the operation matters because the infected boxes could be used for proxy traffic, ad fraud and remote access, while the backdoor may remain on devices after the control network is disabled.
Google’s Threat Intelligence Group said the botnet’s backdoor and operations were developed and run for financial gain by Videostrong, an Android device maker based in Shenzhen. Google said it reached that conclusion with “high confidence.” Videostrong did not respond to requests for comment from The Record and heise, according to the source report. Google has not published the court filing behind its legal actions, and the available material does not identify a court or case number.
The disruption involved Google, Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google said legal action targeted domains and servers used to control the botnet and distribute malware, as well as control servers associated with more than a dozen malware families. It also barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it had tightened firmware-integrity checks for certified Android TV products.
Google counted more than 1.3 million set-top boxes in the network. TrendAI reported 1,472,554 infected devices counted between June 3 and Oct. 1, 2026, describing that figure as a lower bound. The figures refer to observations over that stated period, not a confirmed count of devices still online after the disruption. Google also estimates that taking down servers for add-on malware could cut off access to at least 10 million additional compromised devices. That is an estimate, and the source report says those devices do not all run Android.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Backdoor May Survive the Takedown
Disabling a botnet’s control servers can stop operators from directing connected devices through that infrastructure, but it does not necessarily clean the devices themselves. Google says XCPE’s small system app was embedded in firmware with system-level privileges and could reinstall itself from a protected partition after a reboot. That means removing the app through ordinary settings may not remove the backdoor, according to the company.
The devices were used mainly as residential proxies, routing outside traffic through owners’ home internet connections, and for ad fraud. Google also says the operators could capture live screenshots, inject keystrokes, collect account and device information, open remote shells and scan local networks. Those capabilities create risks beyond unwanted network use, though the source material does not identify particular victims or document specific resulting losses.
The case also raises a supply-chain concern: Google says some affected boxes were Google-certified. It says Videostrong used obfuscation and loaded malicious code after a device’s first boot to evade checks. Certification is not proof that every device is safe, and a compromised home box can also be relevant to businesses if it shares a network with work equipment or services.
Products Worth Considering
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
Samsung Galaxy Tab A7 Lite 8.7 32GB Wi‑Fi Android Tablet – Long‑Lasting Battery, Compact Slim Design, Sturdy Metal Frame (US Version)
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was placed in device firmware before the boxes reached users. The malware reportedly appeared as a system app called x.cpe or, in some versions, com.oemservice. It contacted a control server when the device started, received instructions and maintained a connection for further commands.
Google says the operation used a layered structure: a component that contacted the server, a separate loader and modules supplied by affiliates. Those modules enabled different money-making activities. Since at least late 2024, according to Google, the system had used these layers; in August 2026, new droppers disguised as Android system apps began replacing the loader. Google interpreted that change as an effort to remain hidden.
Google’s actions target both the XCPE infrastructure and servers associated with other malware that could be installed on the boxes. The stated figure of at least 10 million additional devices is Google’s estimate of the broader effect of those server disruptions, not a separately verified total of devices in the XCPE botnet.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Resolve
The available information does not establish how many infected boxes remain in users’ homes, how many were still communicating with operators when the servers were disabled, or whether every control server and related malware family has been addressed. Google’s estimate of at least 10 million additional compromised devices is not a device-by-device count, and the source material says the estimate includes devices outside Android.
The details of Google’s legal action are also not publicly documented in the material available here: Google did not publish its court filing, and no public case record, court or case number is identified. Videostrong’s response to the allegations is not included; the source report says the company did not reply to requests for comment. It is also unclear whether affected devices will receive a firmware update capable of removing the backdoor, or whether users will need to replace them.
Check Devices and Firmware Changes
Google says it has changed its review process for certified Android TV firmware and barred Videostrong from supplying certified Android products. Further details about those checks, any remediation for already-sold devices and the status of the legal proceedings have not been provided in the source material.
For owners, the source report recommends checking whether a TV box is Play Protect certified and being cautious with no-name or “unlocked” products. Because Google says the backdoor can survive an app removal and reboot, owners who suspect infection can treat the box as untrusted, disconnect it or replace it, and keep TV boxes on a separate guest network. Businesses should account for home and office connected devices as part of their security exposure rather than relying on an IP address’s reputation alone.
Key Questions
What is the XCPE botnet?
XCPE was a botnet built from Android set-top boxes with a firmware backdoor, according to Google. The company said the network included more than 1.3 million boxes.
Who does Google say was responsible?
Google attributes the backdoor and botnet operation to Videostrong Technology Co. and says it has high confidence in that assessment. The source material does not include a company response or a court finding.
Does the takedown remove the malware from a TV box?
Not necessarily. Google says the takedown disabled control infrastructure, but the backdoor remains in firmware and can reinstall itself after a reboot. The source material does not describe a confirmed removal method or a firmware fix for affected devices.
What should owners of Android TV boxes do?
Check the device’s Play Protect certification and be wary of no-name or “unlocked” boxes. If a device seems suspicious, the source report advises treating it as untrusted, disconnecting or replacing it, and keeping it on a separate guest network.
Source: ThorstenMeyerAI.com
