🔍 Read the full analysis: Did The Malware Come From The Factory? Google Disrupts A TV Box Botnet on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google said on Nov. 2 that it and partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes. Google attributes the firmware backdoor to Videostrong Technology, but says the backdoor can remain after the disruption and reinstall after a reboot.
Google’s Threat Intelligence Group said Nov. 2 that it had worked with industry partners and Japan’s National Police Agency to disrupt the control infrastructure of XCPE, a botnet involving more than 1.3 million Android set-top boxes. Google said with high confidence that device maker Videostrong Technology built and operated a backdoor in the boxes’ firmware, allowing infected devices to be used for proxy traffic, ad fraud and other remote activity.
Google said the disruption took place in late October and involved legal action against domains and servers used to control the botnet and distribute malware. It also said it targeted control servers for more than a dozen malware families that had been installed as add-ons. The operation involved Lumen, HUMAN Security, Plume, Synthient and TrendAI, as well as Japan’s National Police Agency.
The botnet’s scale depends on the measure cited. Google described it as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and characterized that figure as a lower bound. Google separately estimated that shutting down control servers for add-on malware could cut access to at least 10 million additional compromised devices. That is an estimate, not a confirmed count, and the source report says those devices do not all run Android.
According to Google, most infected boxes were used as residential proxies, routing other people’s internet traffic through an owner’s connection, and for ad fraud. Google also reported that operators could capture screenshots, simulate keystrokes, collect account and device information, and open remote command shells. It said the backdoor was embedded in firmware and could reinstall after a reboot, so removing an associated app would not necessarily clean an affected device.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why a TV Box Can Expose a Network
The case matters because the reported route of infection differs from the usual account of malware arriving through a malicious link or app install. Google says the backdoor was placed in device firmware by the manufacturer, meaning owners may have received an already-compromised box. Some affected devices were Google-certified, according to Google, which said Videostrong used obfuscation to load malicious code after the initial boot and evade checks.
A compromised box can make a household or office internet address appear to be the source of traffic generated by someone else. That can expose owners to service disruption or unwanted scrutiny, while the reported remote capabilities could put other devices on the same network at risk. The broader lesson for organizations is that connected devices, including low-cost TV boxes, can form part of an attack surface even when they are not used for work.
Google said it has banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. It also said it has tightened firmware integrity checks for certified Android TV devices. Those steps address future certification and control infrastructure, but do not by themselves establish that every affected box has been cleaned.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 512GB SSD, and 12MP Center Stage camera
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Apple Watch SE 3 GPS Smartwatch, 40mm
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor appeared as a small system application, identified in some builds as x.cpe or com.oemservice. It had system-level privileges and, according to Google, could restore itself from a protected partition after a user removed it and restarted the device. On startup, the software contacted a control server and could receive instructions or additional components.
Google says the operation had several layers: a component that communicated with the server, a loader, and modules used to generate revenue. Those modules were supplied by affiliates, according to the report. Google also said the software disabled Google Play Protect checks before installing additional apps. It described changes to the malware in August 2026, when droppers disguised as Android system apps began replacing the loader.
The takedown combined disruption of the infrastructure with measures against Videostrong and related malware servers. Google said it took legal action but did not publish the court filing in the material cited here. The source material does not identify a court or case number. Videostrong did not respond to requests for comment from The Record and heise, according to the source report.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
The immediate effect of the operation is not the same as a confirmed cleanup of infected devices. Google says control servers and domains were taken down, but the backdoor remains in firmware and can reinstall after a reboot. The source material does not say how many boxes remain infected, how many owners have replaced or disconnected them, or whether every route to the operators has been cut off.
Important details about the legal action are also not public in the cited material: no filing, court, or case number is provided. Videostrong’s response was not available; the source report says the company did not answer requests for comment from The Record and heise. Google’s estimated effect on at least 10 million additional devices is not a verified device-by-device count, and the affected devices are not all said to be Android products.
Checks for Owners and Administrators
Owners who are concerned can check whether a box is Play Protect certified, though certification alone should not be treated as proof that a device is safe: Google said some infected boxes had been certified. The source material advises treating a suspicious or unidentified box as untrusted, unplugging or replacing it, and keeping TV boxes on a separate guest network where possible. Removing an app alone may not remove a firmware-level backdoor.
Organizations should review connected TV boxes and other low-cost IoT devices on home and office networks, and avoid relying only on an internet address’s reputation when evaluating suspicious traffic. Further developments may include additional information from Google or its partners about affected models, remediation and the results of legal action. No further public milestone is specified in the source material.
Key Questions
What is XCPE?
XCPE is a botnet that Google says used compromised Android set-top boxes. Google reported more than 1.3 million boxes involved; TrendAI counted 1,472,554 devices between June 3 and Oct. 1, 2026, describing its figure as a lower bound.
Who does Google say was behind the backdoor?
Google says with high confidence that Shenzhen-based device maker Videostrong Technology built and operated it for financial gain. That is Google’s attribution; the source material does not cite a court finding, and Videostrong did not respond to requests for comment reported by The Record and heise.
Did the takedown remove the malware from TV boxes?
Not necessarily. Google said the operation disrupted the control infrastructure, but the backdoor remains in firmware and may reinstall after a reboot. The source material does not provide a count of devices that have been cleaned or replaced.
What should an owner do about a suspicious TV box?
Check its Play Protect certification, but do not treat certification as a guarantee because Google said some affected boxes were certified. If the device is suspicious, the source advises unplugging or replacing it and placing TV boxes on a separate guest network. Uninstalling an app may not remove the firmware backdoor.
Source: ThorstenMeyerAI.com
