🔍 Read the full analysis: Google Disrupts 1.3-Million-Device Botnet Built Around TV Boxes on ThorstenMeyerAI.com
TL;DR
Google and industry partners disrupted the XCPE botnet’s control infrastructure in late October, after Google reported more than 1.3 million affected TV boxes. Google attributes the firmware backdoor to device maker Videostrong, but the company’s role is an allegation by Google; the backdoor may remain after the disruption and can return after a reboot.
Google and industry partners disrupted the XCPE botnet’s control servers in late October, cutting off remote access to a network that Google says included more than 1.3 million Android TV boxes. Google’s Threat Intelligence Group (GTIG) attributes the firmware backdoor to Shenzhen-based device maker Videostrong Technology Co.; the company’s alleged role and financial motive are claims made by Google.
Google published its account on November 2, saying it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. The operation targeted domains and servers used to control the botnet and deliver malware. Google also said legal action targeted control servers for more than a dozen malware families found as add-ons on infected devices.
The figures come from different sources and should not be treated as identical counts. Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and characterized that tally as a lower bound. Google said the infected boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ connections, and for ad fraud. GTIG also reported capabilities including taking screenshots, injecting keystrokes, collecting account and device information, and opening remote shells.
Google said it had high confidence Videostrong intentionally developed, deployed and operated the backdoor for financial gain, and sold access to criminal partners. Google’s response also included barring Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, alongside changes to firmware-integrity reviews. Videostrong did not respond to requests for comment reported by The Record and heise, according to the source material.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
A TV Box Can Expose a Home Network
The case matters because the boxes were not described as being infected only after an owner clicked a malicious link or installed a suspicious app. Google says the backdoor was embedded in firmware before devices reached consumers. If accurate, that makes ordinary user precautions such as avoiding dubious downloads insufficient to address the underlying problem.
As a residential proxy, an infected box can make another party’s internet activity appear to come from the household’s connection. That can create reputational and security risks for owners, while the reported remote-control features could give operators access to information on the device or visibility into parts of a local network. The source material does not establish that every listed capability was used against every affected owner.
Google said some affected devices were Google-certified. It alleges Videostrong evaded checks by having malicious code load after a device’s first boot. That raises questions about what certification can and cannot establish about firmware behavior over time. Google’s ban and revised review process address its certified-device ecosystem, but do not themselves remove persistent firmware from boxes already in use.
Popular right now
TCL 65-Inch QM6K QLED Mini-LED 4K HDR Smart Google TV, 144Hz
Dyson V8 Cyclone Cordless Vacuum
Philips 2200 Series Fully Automatic Espresso Machine with Classic Milk Frother, 2 Coffee Varieties, Intuitive Touch Display, Ceramic Grinder
As an affiliate, we earn on qualifying purchases.
How XCPE Stayed on the Boxes
GTIG’s report, titled “Shutting the Door on the XCPE Botnet,” describes a system app identified in some builds as x.cpe and in others as com.oemservice. Google says it had system-level privileges and could restore itself from a protected partition after a reboot if removed. That means the server disruption and removal of an ordinary app are separate issues: the control channel may be cut while the firmware component remains.
According to Google, an infected box contacted a control server after startup, received settings and maintained a connection that operators could use to deliver commands or software. The company described a layered design, with a small component communicating with the server, a separate loader and additional modules. Google said the architecture had been in place since at least late 2024; in August 2026, it observed new droppers disguised as Android system apps.
The botnet’s modules could support different uses, including proxy services and ad fraud. Google also reported that malware families found as add-ons had spread through other channels. It estimates the server takedowns could cut off access to at least 10 million additional compromised devices. That is Google’s estimate of a wider effect, not a verified count of devices in the XCPE botnet, and the source material says not all of those additional devices run Android.
„“More than 1.3 million set-top boxes”“
— Google Threat Intelligence Group
What the Server Takedown Leaves Open
The available material does not identify a public court filing, case number or court for Google’s legal actions. It also does not include a response from Videostrong. Google’s attribution and account of the manufacturer’s motive should therefore be understood as the company’s findings, not as a publicly documented court determination in the material provided.
The disruption’s effect on devices already in homes is also limited by what is known about the persistent firmware. Google says the backdoor can restore itself after a reboot; the source does not say the takedown remotely removed it or provide a complete list of affected brands and models. It is not clear how many devices remain active, how many owners have been notified, or whether other control infrastructure could be used later.
The figure of more than 10 million additional devices is an estimate tied to other malware families’ control servers, not a confirmed count of devices removed from criminal control. The source material does not give the method behind that estimate or a breakdown by operating system. The number of boxes affected by each of the reported activities is also not specified.
Device Checks and Firmware Reviews
Google says it has changed its review process for the firmware integrity of certified Android TV devices and barred Videostrong and its future subsidiaries or affiliates from participation in its certified-device program. The source material does not provide a timeline for those changes, identify a public list of affected product models, or say whether further law-enforcement action is planned.
For owners, Google’s certification status can be checked through Play Protect, but certification alone cannot establish that a particular box is unaffected. The source recommends treating a suspicious device as untrusted: unplug it or replace it, and use a separate guest network for TV boxes where possible. It also says uninstalling an app may not remove the firmware backdoor. Businesses should account for home and office internet-connected devices in their security planning rather than relying only on the reputation of an IP address.
Further reporting would be needed to establish which models and batches were affected, what proportion of the reported devices remain reachable, and whether the manufacturers or resellers will offer firmware updates or replacement options. Until those details are available, the confirmed development is that the reported control infrastructure was disrupted—not that every infected box has been cleaned.
Key Questions
What happened to the XCPE botnet?
Google says it and industry partners disrupted the botnet’s control servers and domains in late October 2026, with help from Japan’s National Police Agency. The operation was intended to cut operators’ remote access to infected TV boxes and other malware infrastructure.
How many TV boxes were affected?
Google reported more than 1.3 million set-top boxes. TrendAI separately counted 1,472,554 infected devices between June 3 and October 1, 2026, describing its count as a lower bound. The sources present these as separate measurements.
Did Google blame the device maker?
Yes. Google said it had high confidence that Videostrong Technology Co. developed and operated the backdoor for financial gain. That is Google’s attribution; the source material says Videostrong did not respond to requests for comment reported by The Record and heise.
Does disconnecting the botnet remove malware from a box?
Not necessarily. Google says the firmware backdoor can restore itself after a reboot, so disrupting its control servers is not the same as removing the component from a device. The source material does not provide a complete removal method or a list of affected models.
What should TV-box owners do?
Check the device’s Play Protect certification, be cautious with unknown or “unlocked” boxes, and consider unplugging or replacing a suspicious device. The source also recommends connecting TV boxes to a separate guest network where possible; uninstalling an app may not remove a firmware-level backdoor.
Source: ThorstenMeyerAI.com
