Threats · 5h ago
Google says its XCPE takedown severed bot-herders’ control of more than 10 million additional devices, beyond the 1.3 million Android set-top boxes in the botnet. The action targeted command servers used by malware modules distributed by Videostrong and its affiliates.
Videostrong gave criminal affiliates access to its device backdoor and let them load their own malware modules. Because those modules used command servers beyond XCPE’s original infrastructure, taking down those servers cut remote control across a much wider set of devices. It did not remove XCPE’s backdoor from infected hardware: the implant sits in a protected partition and reinstalls after reboot.
For organizations with XCPE-infected boxes, the backdoor remains even though operators lost command access. The reporting does not establish whether the additional devices retain implants, leaving the scale of residual compromise beyond the original botnet unclear.
11 sources covering this story
The Record from Recorded Future
Google dismantles massive botnet hidden in Android TV boxes
The overwhelming majority of the infected devices in the X.CPE botnet are Android TV set-top boxes, Google said, adding that they observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices.
Google dismantles botnet secretly running on 1.3 million Android TV boxes
Google has cut ties with the company behind the botnet campaign.
Police and Tech Firms Team Up to Dismantle XCPE Botnet
Google and partners have taken down the XCPE botnet attributed to Chinese device maker Videostrong
Google Dismantles XCPE Botnet of 1.3 Million Android Devices
The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology.
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud.
Google shuts down global botnet running on certified Android devices
Videostrong sold TV set-top boxes and other devices with pre-installed malware.
Cops bust botnet of 1.3M infected Android TV boxes
Videostrong accused of shipping devices with a backdoor baked in
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities.
Google disrupts XCPE botnet, bans the company behind it - Help Net Security
Google disrupted the XCPE botnet, a backdoor built into the firmware of more than 1.3 million Android TV set-top boxes by their maker.
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
Google disrupts the x.cpe botnet on over 1.3 million Android devices, linking the firmware backdoor to manufacturer Videostrong.
Shutting the Door on the XCPE Botnet | Google Cloud Blog
Google and industry partners have dismantled the XCPE backdoor and botnet, which was intentionally developed and operated by OEM Videostrong Technology Co.
Part of the PlainSec briefing for 2026-11-03