TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and industry partners disrupted the control infrastructure for the XCPE botnet, which Google says involved more than 1.3 million set-top boxes. Google alleges that device maker Videostrong built and operated the firmware backdoor; the company has not responded to media requests. The takedown cuts off remote control, but Google says the backdoor remains in device firmware and can return after a reboot.
Google and industry partners disrupted the control infrastructure for the XCPE botnet in late October, a network that Google says involved more than 1.3 million Android set-top boxes. Google alleges that Shenzhen-based manufacturer Videostrong Technology Co. built and operated the firmware backdoor for profit, leaving infected devices available for residential proxy traffic, ad fraud and other remote activity.
Google’s Threat Intelligence Group (GTIG) described the operation in a report published November 2. It said the takedown involved legal action against domains and servers used to control the botnet and distribute malware, as well as control servers for more than a dozen additional malware families. Google worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.
TrendAI counted 1,472,554 infected devices from June 3 through October 1, 2026, and described its figure as a lower bound. Google separately referred to more than 1.3 million set-top boxes. Google also estimated that disabling servers for the additional malware families would cut access to at least 10 million more compromised devices. That figure is an estimate, not a device count from the XCPE investigation, and reporting by BleepingComputer says those additional devices did not all run Android.
GTIG says infected boxes mainly operated as residential proxies, sending other parties’ traffic through owners’ internet connections, and as tools for ad fraud. It also observed operators capturing screenshots, injecting keystrokes, collecting account and device information, and opening remote shells. These are capabilities Google reported; the material provided does not establish that every infected box was used for every activity.
A factory backdoor powered a TV box botnet Google disrupted its control servers
Google and industry partners disrupted the XCPE botnet in late October 2026. The server takedown cuts off remote control, but the backdoor may remain in device firmware.
What the boxes could do
GTIG reported remote capabilities; it did not establish that every infected box was used for each activity.
Residential proxies
Operators could route other parties’ traffic through owners’ internet connections.
Ad fraud
Google said infected boxes were used as tools for ad fraud.
Commands and data
Reported capabilities included screenshots, keystrokes, account and device data, and remote shells.
Why the backdoor can return
The takedown disrupted control infrastructure, but did not remove the firmware component.
The system app contacted a control server when the device started.
Operators could install apps, run commands, capture screens and scan the local network.
Google says the backdoor can reinstall from a protected firmware partition.
Response and remaining questions
- Google and partners disrupted XCPE control servers in late October.
- Google banned Videostrong from making certified Android devices or supplying software to certified vendors.
- Google says it tightened firmware review.
- Which brands and models were affected.
- How many boxes remain infected.
- Whether a lasting firmware fix will be available.
- How owners can confirm whether a specific box was compromised.
The Backdoor Survives the Server Takedown
The disruption targets the botnet’s ability to receive commands, but it does not remove the underlying firmware component. Google says the backdoor can reinstall itself from a protected partition after a reboot, so uninstalling an app may not clean an affected box. The gap matters to owners: a device can look like an ordinary streaming product while its network connection and system access are exposed to remote operators.
The case also raises questions about trust in device supply chains. Google says some infected devices had been certified for Android, and that Videostrong used obfuscation to load malicious code after a device’s first boot to evade checks. Google has banned the manufacturer from making certified Android devices or supplying software to certified vendors, and says it has tightened firmware review. That response addresses certification and review processes, while users may still have to deal with devices already in circulation.
For businesses, the reported proxy activity shows why connected devices on home or office networks can matter beyond their own screens. A compromised box may provide a route for other people’s traffic through a trusted connection. Google’s report recommends treating such devices as part of the network’s exposure; relying only on the apparent reputation of an IP address may miss that the traffic is being relayed through a victim’s connection.
Products Worth Considering
Bose Lifestyle Ultra Wireless Home Speaker, White Smoke
Arlo Ultra 4K HDR Wireless Security Camera (3rd Gen), 3-Camera Kit with SmartHub
Arlo Pro Wireless Security Camera, 2K HDR, 6th Gen, 4-Camera Kit
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Devices
According to GTIG, the backdoor was a small system app identified as x.cpe, or com.oemservice in some device builds. It ran with system-level privileges and contacted a control server when the box started. Google says the component could fetch settings and maintain a connection through which operators could install apps without user approval, run commands, capture screens and scan the local network.
The report says the code could disable Google Play Protect’s app checks before installing other software. If a user removed the app, GTIG says it could be restored from a protected firmware partition at the next reboot. Since at least late 2024, Google says the design had separate components for server communication, loading code and running monetization modules supplied by criminal partners. In August 2026, GTIG observed new droppers disguised as Android system apps replacing the loader, which it interpreted as an effort to maintain concealment.
Google’s report attributes the backdoor and botnet to Videostrong, an Android original equipment and design manufacturer that builds devices for its own and other brands. Google says the company intentionally developed, deployed and operated the system for financial gain. Videostrong did not respond to comment requests from The Record and heise, according to the source material. The source material also says Google did not publish a court filing and provides no public case number or court record.
“The backdoor and botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
Owners and Cleanup Remain Unclear
The available material does not identify every affected brand or model, give a complete list of devices, or say how many boxes remain infected after the server disruption. It also does not establish whether the backdoor can be removed through a firmware update, whether manufacturers will issue updates, or how owners can confirm that an individual device was compromised.
Google’s allegation against Videostrong is not accompanied in the source material by a published court filing or public case record. Videostrong’s response is also unavailable. The estimate of at least 10 million additional compromised devices is a projection of the effect on other malware families, not a confirmed count of devices tied to XCPE.
Because the firmware component may persist after the control servers are disabled, the status of any one box cannot be inferred from the takedown alone. The source material does not say whether all operators lost access at once or whether any control infrastructure remains active.
Check Certification and Network Access
Google says it has banned Videostrong from producing certified Android devices and supplying software to certified vendors, and has changed its firmware integrity review process. The source material does not provide a timeline for further enforcement actions, firmware fixes or a public list of affected products.
Owners can check whether a box is Play Protect certified and be cautious with unbranded or “unlocked” devices, though certification alone does not establish whether a particular device is infected. For a box suspected of compromise, the source material advises treating it as untrusted: unplug it or replace it, and keep TV boxes on a separate guest network. Businesses can review connected devices on their networks and avoid assuming that traffic is safe based only on its apparent IP reputation.
The next practical milestone is clearer device guidance from Google, manufacturers or security partners, including which models are affected and whether a lasting firmware remedy is available. Until that information is published, owners should not assume that removing an app or rebooting a box removes the backdoor.
Key Questions
What is the XCPE botnet?
XCPE was a network of Android set-top boxes that Google says were infected with a firmware backdoor. Operators used the devices mainly as residential proxies and for ad fraud, with other remote capabilities also reported by Google.
How many devices were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, calling that a lower bound.
Did Google remove the malware from the boxes?
The reported action disrupted control servers; it did not remove the firmware backdoor. Google says the component can reinstall after a reboot, so uninstalling an app may not clean an affected device.
What should an owner do with a suspicious TV box?
The source material advises checking Play Protect certification, treating a suspected device as untrusted, and unplugging or replacing it. It also recommends placing TV boxes on a separate guest network.
Has Videostrong responded to Google’s allegation?
The source material says Videostrong did not respond to comment requests from The Record and heise. It also says Google did not publish a court filing, and no public case number or court record was identified.
Source: Thorsten Meyer AI
