🔍 Read the full analysis: What We Know About The Factory-Linked TV Box Botnet Google Disrupted on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and partners disrupted the control infrastructure for XCPE, a botnet Google says was built into firmware on more than 1.3 million Android TV boxes. Google attributes the operation to manufacturer Videostrong, but the takedown does not remove the backdoor from infected devices, and the full scope of the disruption remains unclear.
Google says it and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to operate more than 1.3 million set-top boxes. Google’s Threat Intelligence Group (GTIG) attributes the firmware backdoor to device maker Videostrong Technology Co., saying the boxes were compromised before they reached owners and used for activities including proxy services and ad fraud.
In a report published November 2, Google said the botnet’s backdoor and operation were developed and run for financial gain by Videostrong, an Android device manufacturer that makes products for its own brand and other sellers. Google said it had high confidence in that attribution. Videostrong did not respond to comment requests from The Record and heise, according to the source report.
Google worked with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. The response included legal action to disrupt domains and servers used to control the botnet and distribute malware, as well as control servers for more than a dozen additional malware families. Google also barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it had tightened firmware-integrity checks for certified Android TV devices.
The infected boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ connections, and for ad fraud, according to Google. GTIG also reported capabilities to capture live screenshots, inject keystrokes, collect account and device information, and open remote shells. These are capabilities described in Google’s report; the available source material does not establish that every infected box performed each action.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A Backdoor Built Into TV Boxes
The case stands out because the compromise was reportedly placed in device firmware before sale, rather than relying on an owner to click a malicious link or install a harmful app. That shifts the security concern from individual user behavior to the manufacturing and software supply chain. A buyer may have little reason to suspect that a device marketed as a streaming box is also routing outside traffic through a home connection.
Residential proxy activity can make third-party internet traffic appear to come from a household or office, potentially exposing the owner to questions about activity they did not initiate. The reported remote-access capabilities also raise a broader concern: a compromised TV box connected to a home or business network could be a foothold for surveillance or other activity. The source material does not say that all these outcomes occurred, but it describes tools that could enable them.
Google’s response also highlights a limit of botnet disruptions. Cutting off control servers can prevent operators from issuing commands through those servers, but it does not necessarily clean the affected devices. Google says the backdoor can restore itself after a reboot, so owners may need to treat affected hardware as untrusted rather than relying on deleting an app.
Products Worth Considering
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the XCPE Infection Persisted
Google described a system app, identified in some builds as x.cpe or com.oemservice, embedded in firmware with elevated privileges. According to GTIG, if a user removed the app, it could be restored from a protected partition when the box restarted. The device then contacted a control server for instructions and could receive additional software or commands.
Google said the operation had developed into a layered system by at least late 2024, with a component that contacted the server, a separate loader and modules that generated revenue. In August 2026, GTIG observed new droppers disguised as Android system apps replacing the loader, which it interpreted as an attempt to remain concealed. Some affected boxes had Google certification, according to Google; the company said the manufacturer used obfuscation to load malicious code after the initial boot and evade checks.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described its count as a lower bound. Google used the broader figure of more than 1.3 million set-top boxes. Google also estimated that disruption of control servers for related malware families could cut off access to at least 10 million additional compromised devices. That figure is an estimate, not a confirmed device count, and the source report says not all those devices necessarily run Android.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Has Not Fixed
Google’s action disrupted the botnet’s control infrastructure, but the available information does not establish how many devices remain infected, whether all control servers were disabled, or whether operators have established replacement infrastructure. Google says the firmware backdoor can persist and reinstall after a reboot, meaning the disruption is not the same as removal of malware from every box.
The source material also does not identify all affected models or brands, or provide a public court filing, case number or court for the legal action. Google’s attribution to Videostrong is an intelligence assessment, and the company did not respond to the cited media outlets’ requests for comment. The estimate of at least 10 million additional compromised devices is not a measured count of devices directly infected through XCPE.
Checks for Owners and Vendors
Owners can check whether a device is Play Protect certified, but certification alone may not settle whether a particular box has been affected, given Google’s report that some certified devices were compromised. The source report advises caution with no-name or “unlocked” boxes and says a suspicious device should be unplugged or replaced. Removing an app is not a reliable remedy if the firmware restores it after a restart.
Separating TV boxes and other connected devices onto a guest network can limit their access to a main home network. For businesses, the incident is a reminder to treat office and home internet-connected devices as part of the security perimeter, rather than relying on an IP address’s reputation to determine whether traffic is trustworthy. Google has said it changed its review process; further detail on the affected device range, the legal action and any lasting cleanup measures was not provided in the source material.
Key Questions
What is the XCPE botnet?
XCPE is the name Google uses for a botnet involving Android TV boxes with a firmware backdoor. Google said more than 1.3 million set-top boxes were involved.
Who does Google say was behind the backdoor?
Google’s Threat Intelligence Group attributes the backdoor and botnet to Videostrong Technology Co. and says it has high confidence in that assessment. The available source material does not describe this as a court finding, and Videostrong did not respond to the cited media outlets’ requests for comment.
Does the takedown remove the backdoor from an infected box?
No. Google says the action disrupted the control infrastructure, but the backdoor remains in firmware and can reinstall itself after a reboot. Uninstalling the app is not described as a lasting fix.
What did the infected boxes do?
Google says they were used mainly as residential proxies and for ad fraud. GTIG also reported capabilities including screenshots, keystroke injection, data collection and remote shells, but the source does not say every infected box used all of those capabilities.
What should owners do if they suspect their TV box is affected?
Check the device’s Play Protect certification and treat a suspicious box as untrusted. The source report advises unplugging or replacing it and placing TV boxes on a separate guest network; it says removing an app may not work because the firmware can restore the backdoor.
Source: ThorstenMeyerAI.com
