🔍 Read the full analysis: Google’s Botnet Takedown Puts Factory Malware In The Spotlight on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners disrupted the control infrastructure for XCPE, a botnet made up of more than 1.3 million set-top boxes, according to Google and partner TrendAI. Google alleges with high confidence that device maker Videostrong built and operated the firmware backdoor for profit; the malware reportedly remains on affected boxes and can return after a reboot.
Google said on Nov. 2 that it and industry partners had disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million Android set-top boxes. Google alleges with high confidence that Shenzhen-based manufacturer Videostrong Technology Co. built and operated the firmware backdoor for profit, meaning the malware could be present before a device reached its buyer.
Google’s Threat Intelligence Group said the operation was carried out in late October with the Japan National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. The response included legal action targeting domains and servers used to control the botnet and distribute malware, as well as servers associated with more than a dozen malware families loaded onto devices as add-ons. Google also said it had barred Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to certified vendors.
Google described XCPE as a network of compromised set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and said its figure was a lower bound. Google’s own description was “more than 1.3 million set-top boxes.” The figures refer to devices observed during a stated period, not a confirmed count of boxes still online after the disruption.
According to Google, the boxes were used mainly as residential proxies, routing other people’s internet traffic through household connections, and for ad fraud. Google also reported that operators could take screenshots, inject keystrokes, collect account and device information, and open remote shells. These are capabilities described in Google’s report; the source material does not establish that every infected device was used for every listed purpose.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Backdoor That Survives Reboots
The case shifts attention from malicious apps downloaded by users to firmware compromised before sale. If a backdoor is built into a device’s system software, ordinary steps such as uninstalling an app may not remove it. Google says the XCPE component can restore itself from a protected partition after a reboot, leaving owners with fewer reliable ways to clean an affected box than they would have for a standard app infection.
Compromised home devices can also lend their internet addresses to outside traffic, making activity appear to come from ordinary households. For users, that creates privacy and security concerns; for businesses, it complicates efforts to judge network traffic by IP address alone. Google said the takedown of control servers for the add-on malware could cut access to at least 10 million additional compromised devices. That is the company’s estimate, not a measured count, and the devices are not all necessarily Android products.
The episode also raises questions about the reach of certification checks. Google said some infected devices were certified and that Videostrong used obfuscation to evade review by loading malicious code after the first boot. Google says it has changed its firmware review process, but the details and the effectiveness of those changes have not been independently established in the material provided.
Products Worth Considering
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the XCPE Infection Worked
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was a small system app identified as x.cpe or, in some builds, com.oemservice. It had system-level access and, according to Google, contacted a control server when the box started. The operators could then send instructions or install additional software remotely.
Google said removing the app did not solve the problem because it could be restored from a protected firmware partition on reboot. The report describes a design with separate components for communicating with the server, loading code and running modules supplied by affiliates. Google said the setup had been in place since at least late 2024; it also reported that new droppers disguised as Android system apps appeared in August 2026.
Google attributed the operation to Videostrong with “high confidence” and said the company developed, deployed and operated the botnet for financial gain. The source material says Videostrong did not respond to comment requests from The Record and heise. The allegation should not be read as an independently adjudicated finding: no public court filing or case number was identified in the material supplied.
““high confidence””
— Google Threat Intelligence Group
What the Takedown Does Not Resolve
The disruption targeted control infrastructure; it does not establish that the backdoor has been removed from infected devices. Google’s account says the component can reinstall after a reboot, and the source material does not describe a remote or user-accessible cleanup process that removes it permanently. It also does not say how many affected boxes remain active after the servers were disrupted.
The attribution to Videostrong is Google’s assessment, not a court finding reported in the source material. Videostrong did not respond to comment requests cited there. The precise number of devices affected over the botnet’s full lifetime, the identities of all downstream users and the exact reach of the estimated 10 million additional devices are also unclear. Google’s reported capabilities do not show how often operators used each one or whether particular owners’ data was accessed.
Steps for Owners and Google
Owners concerned about a set-top box can check whether it carries Google Play Protect certification, be cautious about no-name or “unlocked” devices, and treat a suspicious box as untrusted. The source material recommends unplugging or replacing a suspect device rather than relying on an app uninstall, and placing TV boxes on a separate guest network where possible. Those steps reduce exposure but do not prove that a device is clean.
Google says it has tightened firmware integrity checks for certified Android TV devices. The material does not give a timetable for further measures or describe how Google will assess the changes. Security teams and network operators will also need to account for the possibility that compromised household or office devices can generate traffic through residential connections, rather than relying on IP reputation alone.
Key Questions
What was the XCPE botnet?
Google described XCPE as a botnet involving compromised Android set-top boxes. The boxes could be used as residential proxies and for ad fraud, among other reported functions.
How many devices were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and called that a lower bound. The figures do not establish how many remain active after the takedown.
Did Google say Videostrong was responsible?
Yes. Google said it had high confidence that Videostrong built and operated the backdoor and botnet for financial gain. The source material does not report a court finding, and says the company did not respond to requests for comment.
Does the takedown remove malware from a TV box?
Not necessarily. Google’s account says the action disrupted control servers, while the backdoor can remain in firmware and reinstall after a reboot. The supplied material does not describe a confirmed cleanup method for affected boxes.
What should owners do if they suspect a box is infected?
Check its Play Protect certification, avoid trusting unfamiliar or no-name devices, and consider unplugging or replacing a suspect box. Keeping streaming devices on a separate guest network can also limit their access to other devices, but it does not confirm that the box is malware-free.
Source: ThorstenMeyerAI.com
