🔍 Read the full analysis: Google Disrupts A TV Box Botnet After Tracing Malware To The Factory on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and industry partners said they disrupted the XCPE botnet in late October, cutting off its control infrastructure. Google attributes the firmware backdoor to TV-box maker Videostrong; TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, which it describes as a lower bound. The backdoor may remain on affected devices after the takedown.
Google and its partners disrupted the XCPE botnet in late October, cutting off servers used to control infected Android TV boxes, according to a November 2 report from Google’s Threat Intelligence Group. Google says the botnet was built around a firmware backdoor installed by device maker Videostrong Technology Co.; its disruption affects a network involving more than 1.3 million set-top boxes, though the backdoor may remain on devices already infected.
Google said it coordinated with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. The response included legal action targeting domains and servers used to control the botnet and distribute malware, as well as control servers associated with more than a dozen additional malware families found on the boxes. Google also said it barred Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tightened firmware-integrity checks for certified Android TV devices.
The reported device totals use different measures. Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and called that figure a lower bound. Google also estimated that taking down servers for add-on malware could cut off access to at least 10 million more compromised devices. That is an estimate of potential impact, not a direct count of devices confirmed in the XCPE botnet; Google’s report says some of those malware families spread through other channels.
According to Google, infected boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ home connections, and for ad fraud. The company also said operators could capture live screenshots, simulate keystrokes, collect account and device information, open remote shells and install additional apps. These are capabilities described in Google’s report; the published material does not establish that every function was used on every infected box.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Backdoor Can Survive a Reboot
The incident highlights a security risk that a factory reset or app removal may not resolve. Google says the backdoor was embedded in system firmware and could restore itself from a protected partition after a reboot if removed. The takedown targeted the operators’ control infrastructure, not the firmware already installed on each box. Owners therefore should not assume that cutting off the botnet’s servers has cleaned their device.
Using a home connection as a proxy can expose its IP address to activity conducted by someone else, while remote access capabilities could create further risks for data and other devices on the local network. For organizations, the report is a reminder that inexpensive connected devices at homes or offices can form part of their security exposure. Google’s account also raises questions about how malicious firmware passed checks on some Google-certified devices.
Products Worth Considering
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s report describes a small system app, identified in some builds as x.cpe or com.oemservice, that connected infected boxes to the operators’ servers. The app had system-level privileges. Google says it could retrieve instructions and settings, while other components loaded the modules used for proxy activity, ad fraud and additional functions. The report says the malware disabled Google Play Protect app checks before installing further software.
Google says the backdoor was designed to load malicious code after the device’s first boot, a method the company says helped it evade review. Some affected boxes had Android certification, according to Google. The company says it has since changed its firmware review process and banned Videostrong from the certified Android ecosystem. It characterized its finding that Videostrong developed and operated the backdoor for financial gain as a high-confidence attribution. Videostrong did not respond to comment requests from The Record and heise, according to the source material.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
The Remaining Infection Count
The public information does not identify every affected model, brand or owner, nor does it provide a complete, independently verified global count. TrendAI’s figure covers devices counted from June 3 through October 1, 2026; it should not be treated as a current count after the disruption. Google’s estimate of at least 10 million additional devices is broader and refers to malware families that also spread through other routes.
It is also unclear how many infected boxes remain in use, whether operators retained any alternative control methods, and what device makers or users must do to remove the firmware backdoor. Google says the backdoor can reinstall after a reboot, but the reported server takedown does not itself remove it. The source material says Google took legal action but provides no public court filing, case number or court details. Videostrong’s response was not available.
Device Checks and Remediation
Google says it has banned Videostrong from making certified Android devices and strengthened checks on firmware integrity. The company’s report does not give a public timeline for further enforcement or a device-by-device remediation program. Owners who suspect their box is affected can check whether it carries Google Play Protect certification, avoid no-name or “unlocked” devices, and treat a suspicious box as untrusted. The source material recommends unplugging or replacing it and placing TV boxes on a separate guest network.
Businesses should review connected TV boxes and other low-cost IoT equipment on their networks rather than relying on an IP address’s reputation as proof that traffic is safe. The next practical developments to watch are any device lists or removal guidance from Google and manufacturers, and whether authorities or affected companies publish further details about the legal actions. Until then, the number of devices still carrying the backdoor and the availability of a reliable firmware-level fix remain unresolved.
Key Questions
What happened to the XCPE botnet?
Google and partners said they disrupted it in late October 2026 by taking action against the domains and servers used to control it. Google published its account on November 2.
How many TV boxes were affected?
Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and said its count was a lower bound.
Who does Google say was behind the backdoor?
Google’s Threat Intelligence Group said, with high confidence, that Videostrong Technology Co. developed and operated the backdoor for financial gain. Videostrong had not responded to comment requests cited in the source material.
Does the takedown remove the malware from a TV box?
Not necessarily. Google says the takedown cut off control servers, but the firmware backdoor can restore itself after a reboot. The report does not describe a universal removal tool or confirm that every infected device has been cleaned.
What should owners do if they suspect their box is infected?
Check the device’s Google Play Protect certification and treat a suspicious box as untrusted. The source material recommends unplugging or replacing it and keeping TV boxes on a separate guest network; certification status alone does not establish that a device is free of risk.
Source: ThorstenMeyerAI.com
