🔍 Read the full analysis: Could Your TV Box Be Part Of A Botnet? Google Takes Down 1.3 Million Devices on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google said on Nov. 2 that it worked with industry partners and Japan’s National Police Agency to disrupt the XCPE botnet, which involved more than 1.3 million set-top boxes. Google attributes the firmware backdoor to device maker Videostrong; the disruption cuts off control servers, but Google says the backdoor can remain on affected boxes after a reboot.
Google said Nov. 2 that it and industry partners, working with Japan’s National Police Agency, had disrupted the XCPE botnet, which involved more than 1.3 million set-top boxes. Google says the devices carried a manufacturer-installed firmware backdoor linked to Videostrong Technology, allowing operators to use boxes in homes and offices for activities including proxy traffic and ad fraud.
Google’s Threat Intelligence Group (GTIG) said it took legal action to disable domains and servers used to control the botnet and distribute malware. The company also said it pursued control servers for more than a dozen malware families that had been added to the boxes. Google described the operation as a partnership with the National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.
TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and described its total as a lower bound. Google’s own public description said the botnet involved more than 1.3 million set-top boxes. The figures refer to identified devices during the stated period; neither source’s number establishes how many devices remain infected or connected after the disruption.
GTIG says the backdoor was embedded in firmware and could give operators remote access. The boxes were used mainly as residential proxies, routing third-party internet traffic through users’ connections, and for ad fraud. Google also reported capabilities including capturing live screenshots, injecting keystrokes, collecting account and device information, and opening remote shells. Those are capabilities described by Google, not evidence that every infected device was used for every listed activity.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk of a Factory-Installed Backdoor
This case matters because owners may not have installed a malicious app or clicked a suspicious link. According to Google, the backdoor was placed in device firmware by the manufacturer, giving it system-level access and making it harder to remove than an ordinary app. Some affected boxes were Google-certified, underscoring that certification did not prevent every device from being compromised.
For people whose boxes were affected, the risk is not limited to the box itself. Proxy traffic can make activity by strangers appear to originate from a household’s internet connection. Remote access and network-scanning capabilities could also put other devices on a shared network at risk. Google said the takedown cut off command infrastructure, but it does not amount to a confirmed removal of the backdoor from each box.
Google said the malware families involved had also spread through other channels. The company estimated that disabling their control servers could cut off access to at least 10 million additional compromised devices. That is Google’s estimate, not a verified device count, and the source material says those devices do not all run Android.
Popular right now
TCL 65-Inch QM6K QLED Mini-LED 4K HDR Smart Google TV, 144Hz
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
De'Longhi Rivelia Fully Automatic Espresso Machine with Milk Frother, White
As an affiliate, we earn on qualifying purchases.
How the XCPE Infection Persisted
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was a small system app identified in some builds as x.cpe and in others as com.oemservice. GTIG says it had system-level rights and could reinstall itself from a protected partition after a reboot if removed. That means deleting an app through normal settings would not necessarily eliminate the firmware component.
According to Google, an infected box contacted a control server after startup and could receive instructions or additional software. The company says the operators used multiple components: a program that communicated with the server, a loader and modules that generated revenue. Google also reported that the malware could disable Play Protect app checks before installing other software.
Google attributes the operation to Shenzhen-based Videostrong Technology Co. with what it called “high confidence,” alleging the company developed and operated the backdoor for financial gain and sold access to criminal partners. Google said it has barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and has tightened firmware-integrity reviews. The source material says Videostrong did not respond to requests for comment from The Record and heise.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
The available information does not identify every affected model, brand or retailer, or provide a public list of serial numbers that owners can check. It is also unclear how many infected boxes are still in use, how many were reachable when the control servers were disabled, and whether each device’s remote connection was successfully cut off.
Google says the firmware backdoor can survive a reboot and reinstall itself, so disabling command servers should not be treated as proof that the device is clean. The source material does not describe a consumer firmware update or other remediation that removes the backdoor. Google’s allegations against Videostrong are not accompanied here by a public court filing or case details, and Videostrong’s response was not available.
Owner Checks and Google’s Firmware Review
Google said it has changed its review process for certified Android TV firmware and barred Videostrong from participating in its certified-device program. The company has not, in the material provided, announced a device-by-device notification system or a universal cleanup tool. Further information from Google, affected manufacturers and law enforcement could clarify which products were involved and what owners should do with specific models.
Google advises users to check whether a box is Play Protect-certified and to be cautious with no-name or “unlocked” devices. If a box appears suspicious, the source recommends treating it as untrusted, unplugging or replacing it, and keeping TV boxes on a separate guest network where possible. These steps reduce exposure but do not establish that a device’s firmware has been cleaned. Businesses should also account for connected TV boxes and other internet-connected equipment in their security planning rather than relying on an IP address’s reputation alone.
Key Questions
What is the XCPE botnet?
XCPE is the botnet Google says used compromised set-top boxes running Android-based software. Google reported more than 1.3 million boxes involved and said operators used them for activities including residential proxy traffic and ad fraud.
Does the takedown mean an infected TV box is clean?
No. Google says the disruption disabled control infrastructure, but the firmware backdoor may remain and can reinstall itself after a reboot. The supplied information does not describe a general cleanup tool or confirm that all affected boxes have been repaired.
Were Google-certified devices affected?
Google said some infected boxes were certified. It said Videostrong used obfuscation and loaded malicious code after a device’s first boot, and that Google has since tightened firmware-integrity checks.
What should owners of Android TV boxes do?
Check the device’s Play Protect certification, be wary of unfamiliar or “unlocked” boxes, and consider unplugging or replacing a device that seems suspicious. Keeping a TV box on a separate guest network can limit its access to other devices, but it does not remove firmware malware.
How many devices were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing that figure as a lower bound. The counts use different descriptions and should not be read as a tally of devices confirmed clean after the takedown.
Source: ThorstenMeyerAI.com
