TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to operate more than 1.3 million set-top boxes, according to Google. The company alleges that manufacturer Videostrong built and operated the backdoor for profit; infected firmware may remain on devices after the takedown.
Google and industry partners disrupted the XCPE botnet in late October, cutting off control servers for a network of more than 1.3 million set-top boxes, Google said on November 2. The company alleges that Shenzhen-based manufacturer Videostrong Technology built and operated the firmware backdoor, which let operators use infected devices for residential proxy traffic, ad fraud and other remote activity.
Google’s Threat Intelligence Group (GTIG) said the backdoor was installed in device firmware before affected boxes reached consumers. Owners could see ordinary streaming devices, while the boxes connected through their home internet service to infrastructure controlled by the operators. A separate count from security partner TrendAI recorded 1,472,554 infected devices between June 3 and October 1, 2026, and described that figure as a lower bound.
According to GTIG, the backdoor used a system app called x.cpe, or com.oemservice in some versions. It had system-level privileges, contacted a control server when the box started and could receive instructions to install apps or run commands. Google also reported that operators could capture screenshots, inject keystrokes, collect account and device data, scan local networks and open remote shells. The company said the boxes were used mainly as residential proxies and for ad fraud.
Google said it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. The response included legal action to take down domains and servers used to control the botnet and deliver malware, and to target servers associated with more than a dozen malware families found as add-ons. Google also barred Videostrong and its future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it tightened firmware integrity checks for certified Android TV devices.
Inside the XCPE TV box botnet Disrupted by Google
Google and industry partners cut off the control servers behind a botnet of more than 1.3 million set-top boxes. The firmware backdoor may remain on devices after the disruption.
How the backdoor worked
The firmware foothold let operators direct devices through control servers.
Google said the backdoor was built into device firmware before boxes reached consumers.
The system app x.cpe, or com.oemservice in some versions, contacted a control server.
Operators used boxes mainly for residential proxy traffic and ad fraud, and could issue commands.
What the disruption changed
The response targeted the infrastructure and the company Google attributes to the operation.
- Control servers directed infected boxes.
- Boxes could expose home internet connections and local networks.
- Legal action took down domains and servers used to control the botnet and deliver malware.
- Google barred Videostrong from building certified Android devices or supplying software to certified vendors.
What remains uncertain
The takedown announcement does not show whether an individual box is still infected or has been cleaned.
Firmware can restore the backdoor
Google said it can return from a protected partition after reboot, so removing an app may not remove the foothold.
Brands and models are not fully identified
The source material does not provide a complete list of affected devices or how many remain in use.
Google names Videostrong
Google attributed the operation to Videostrong Technology; the company did not respond to comment requests cited in the source.
Steps for owners and organizations
A server takedown alone is not a device cleanup plan.
- Check the box’s Play Protect certification.
- Treat unfamiliar or suspicious boxes as untrusted; consider unplugging or replacing them.
- Place TV boxes on a separate guest network.
- Organizations should account for connected devices and avoid judging traffic as benign based only on its IP address.
The Firmware Backdoor Persists
The disruption cuts off the infrastructure Google identified as a way to direct infected boxes, but it does not necessarily clean the devices. GTIG said the backdoor is built into firmware and can restore itself from a protected partition after a reboot. That means removing an app may not remove the foothold, and the status of a particular box cannot be determined from the takedown announcement alone.
For households, the case shows that a connected device can expose a home internet connection and local network even when it appears to work normally. For businesses, residential proxy traffic can make malicious activity appear to come from an ordinary customer or office connection. The incident also raises questions about how malicious firmware passed certification checks: Google said some affected devices were certified and that Videostrong used obfuscation to load the code after a device’s first boot.
Products Worth Considering
Samsung Galaxy Tab A7 Lite 8.7 32GB Wi‑Fi Android Tablet – Long‑Lasting Battery, Compact Slim Design, Sturdy Metal Frame (US Version)
Samsung Galaxy Tab A11 (2026) – 8.7 90Hz Android Tablet, 64GB/4GB Wi‑Fi, Octa-core MediaTek Helio G99, Dual Dolby Speakers, 20W Fast Charger
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” said the operation had at least three layers since late 2024: a small component that communicated with a server, a separate loader, and additional modules supplied by criminal partners. GTIG said new droppers disguised as Android system apps began replacing the loader in August 2026, which it interpreted as an effort to stay hidden.
Google described the devices as Android set-top boxes made by an original equipment and design manufacturer, a company that can produce devices for its own brand or for other brands. The report says the backdoor was present in firmware before sale, rather than arriving only through a user-installed app. In August, according to Google, some dropper components were disguised as system apps. This background matters because ordinary app removal may not reach the protected firmware component.
Google also estimated that shutting down servers used by add-on malware could cut off access to at least 10 million additional compromised devices. That is Google’s estimate, not a direct count of devices in the XCPE botnet; the source material says those other devices were compromised through additional distribution channels and were not all necessarily Android devices.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
Questions About Devices Remain
The source material does not identify the full list of affected brands or models, or say how many infected boxes remain in use after the server disruption. Google’s more than 1.3 million figure and TrendAI’s period-specific count describe the botnet’s reach; neither establishes how many devices are currently online or have been cleaned.
Google said it had high confidence in its attribution to Videostrong. The source material says Videostrong did not respond to comment requests from The Record and heise. It also says Google did not publish a court filing and that no public case record was found, so the legal actions’ case details are not available here. The precise number and types of devices affected by the add-on malware takedowns are also not established by a device count in the source material.
Checking and Replacing Affected Boxes
Google said it has tightened firmware integrity checks for certified Android TV devices and barred Videostrong from the certified Android ecosystem. The company’s report does not provide a schedule for further investigation or describe a consumer firmware cleanup tool. Owners should check a box’s Play Protect certification and treat an unfamiliar or suspicious device as untrusted. The source recommends unplugging or replacing it and placing TV boxes on a separate guest network.
Organizations should account for home and office connected devices when evaluating network activity, and should not rely on an IP address’s reputation alone to determine whether traffic is benign. Further public details about the legal actions, affected device models and any remediation options would clarify the remaining impact.
Key Questions
What was the XCPE botnet?
It was a network of set-top boxes with a backdoor in their firmware. Google said operators used infected devices mainly as residential proxies and for ad fraud, and could also issue other remote commands.
How many devices were affected?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called its count a lower bound.
Does the takedown remove the backdoor?
Not necessarily. Google said the disruption cut off control servers, while the firmware backdoor can restore itself after a reboot. The source material says uninstalling the app does not remove it.
Who does Google say was responsible?
Google’s Threat Intelligence Group attributed the development and operation of the backdoor to Videostrong Technology Co. The source material reports that the company did not respond to comment requests from The Record and heise.
What should owners of a suspicious TV box do?
Check the device’s Play Protect certification. The source recommends unplugging or replacing a suspicious box and placing TV boxes on a separate guest network.
Source: Thorsten Meyer AI
