TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and its partners disrupted the control infrastructure for the XCPE botnet in late October, after identifying more than 1.3 million infected set-top boxes. Google alleges that device maker Videostrong built and operated the firmware backdoor; the company has not responded to media requests. The takedown cuts off remote control, but the backdoor remains on affected devices and can return after rebooting.
Google said on November 2 that it and industry partners, working with Japan’s National Police Agency, had disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million Android set-top boxes. Google alleges that device maker Videostrong Technology Co. built and operated the firmware backdoor for profit; the disruption stops the operators’ remote control, but does not remove the backdoor from affected boxes.
Google’s Threat Intelligence Group (GTIG) said it worked with security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI, as well as Japan’s National Police Agency. Google described legal actions targeting domains and servers used to control XCPE and distribute malware add-ons. It also said control servers associated with more than a dozen malware families were taken down. The company did not publish a court filing in the source report, which did not identify a court or case number.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described that count as a lower bound. Google summarized the botnet’s reach as more than 1.3 million set-top boxes. GTIG said the boxes were used mainly as residential proxies, routing third-party internet traffic through owners’ connections, and for ad fraud. It also reported that operators could capture screenshots, inject keystrokes, collect account and device data, and open remote shells.
Google says the backdoor was a system app embedded in device firmware, giving it elevated privileges. In affected versions, removing the app did not permanently remove it: it could reinstall from a protected partition after a reboot. Google said it banned Videostrong and its future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tightened firmware-integrity checks for certified Android TV devices.
Google Disrupts XCPE TV Box Botnet
The takedown cut off the botnet’s control infrastructure, but the firmware backdoor remains on affected devices and can return after rebooting.
How the boxes were used
The reported capabilities could affect device owners and the people or businesses whose traffic passed through their connections.
Residential proxies
Boxes routed third-party internet traffic through household connections.
Ad fraud
The botnet was also used to support ad fraud.
Remote capabilities
Operators could capture screens, collect data, inject keystrokes, and open remote shells.
What the takedown changed
Google and partners targeted the infrastructure operators used to control XCPE and distribute malware add-ons.
- Remote control of XCPE devices
- Domains and servers used to control the botnet
- Control servers linked to more than a dozen malware families
- The backdoor remains in device firmware
- It can reinstall from a protected partition after rebooting
- No validated removal method is described
Why supply chains matter
Google alleges Videostrong built and operated the backdoor, which was embedded in firmware before devices reached customers.
A system app in affected firmware had elevated privileges.
Google said code was loaded after first boot to get around checks.
The backdoor could reinstall after rebooting, so deleting an app may not clean the box.
Practical steps for owners and businesses
Treat suspected boxes as untrusted and limit what their network connections can reach.
- Check whether the device is Play Protect certified.
- Be cautious with no-name or “unlocked” boxes.
- Unplug or replace a box suspected of infection.
- Keep TV boxes on a separate guest network.
- Businesses should isolate connected devices and avoid relying on IP reputation alone.
A Backdoor Before First Use
The case shifts attention from what users install to what arrives in a device’s firmware. If a manufacturer or supplier places persistent software on a box before sale, ordinary advice such as avoiding suspicious links or deleting an unfamiliar app may not address the risk. Owners may have no obvious sign that a device is routing traffic or participating in ad fraud.
The reported uses can also affect people and organizations beyond the box owner. Residential proxy traffic can make activity appear to come from a household or office connection, while the reported ability to inspect screens, collect data and scan local networks could expose connected devices and accounts. The report does not establish that every infected box used every capability, or that each owner suffered a direct financial loss.
Google’s actions may reduce the reach of the operation, but the remaining firmware backdoor complicates cleanup. Network operators and businesses may need to treat low-cost connected devices as part of their security exposure, even when their IP addresses appear to belong to ordinary homes or offices.
Products Worth Considering
Samsung 27-inch Odyssey G5 QHD Gaming Monitor (G51F)
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Samsung 27-Inch Odyssey OLED G5 QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was built into firmware on some set-top boxes before they reached customers. Google attributed the operation with “high confidence” to Videostrong Technology Co., which it describes as an Android device manufacturer. The source article said Videostrong did not respond to requests for comment from The Record and heise. The allegation remains Google’s; no company response was included in the source material.
Some of the affected devices were Google-certified, according to Google. GTIG said Videostrong used obfuscation to get around checks by loading malicious code after the first boot. Google said it has changed its review process to check firmware integrity more closely. The source report dates the backdoor’s design to at least late 2024 and says that in August 2026 new droppers disguised as Android system apps began replacing the loader.
Google also estimated that taking down control servers for malware add-ons could cut off access to “at least 10 million additional compromised devices.” That figure is an estimate, not a measured count of devices in the XCPE botnet. The source article, citing BleepingComputer, said those additional devices did not all run Android.
““More than 1.3 million set-top boxes””
— Google Threat Intelligence Group
What the Takedown Leaves Behind
The source material does not identify the court or case number for the legal actions, provide a public filing, or include a response from Videostrong. It also does not give a full model-by-model list of affected boxes or establish how many remain connected after the control servers were disrupted.
Google said the backdoor persists in firmware and can reinstall after rebooting, but the source report does not describe a validated removal method for affected devices. It is also unclear how many boxes can receive a secure firmware update, whether their manufacturers will provide one, or how many owners have been notified. Google’s estimate concerning at least 10 million additional devices is not a count, and the source does not specify the full range of device types involved.
Device Checks and Follow-Up
Google said it has barred Videostrong from the certified Android ecosystem and strengthened firmware review for certified Android TV devices. Follow-up reporting and any public legal records may clarify the scope of the actions, the affected products and whether additional manufacturers or vendors were involved.
For owners, the source recommends checking whether a box is Play Protect certified and being cautious with no-name or “unlocked” devices. Because removing an app may not remove this firmware backdoor, it advises treating a suspected box as untrusted: unplug it or replace it, and keep TV boxes on a separate guest network. Businesses can reduce exposure by isolating connected devices and avoiding reliance on IP reputation alone.
Key Questions
What is the XCPE botnet?
XCPE is a botnet associated with more than 1.3 million infected set-top boxes, according to Google. The boxes were used mainly to route third-party traffic through residential connections and to support ad fraud.
Who does Google say was behind the backdoor?
Google’s Threat Intelligence Group attributed the backdoor to Videostrong Technology Co. with “high confidence,” alleging that the company built and operated it for financial gain. Videostrong did not respond to media requests cited in the source article.
Did the takedown remove the malware from infected boxes?
No. Google’s action disrupted the botnet’s control infrastructure, but the source says the backdoor remains in firmware and can reinstall after a reboot. The source does not describe a confirmed removal method.
How many devices were infected?
Google said XCPE involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called its count a lower bound.
What should owners of Android TV boxes do?
Check the device’s Play Protect certification and be cautious with no-name or “unlocked” boxes. If a box is suspected of infection, the source recommends unplugging or replacing it and placing TV boxes on a separate guest network.
Source: Thorsten Meyer AI
