Google and Japanese Police Dismantle Botnet of 1.3 Million TV Boxes; Maker Videostrong Accused of Planting Backdoor for Profit
The Google Threat Intelligence Group (GTIG) announced on Nov. 2 that Google, Japan's National Police Agency and several cybersecurity firms dismantled a large botnet known as XCPE in the last week of October. More than 1.3 million set-top boxes, the overwhelming majority of them Android TV boxes, had the backdoor installed before they left the factory. Google said it assesses with high confidence that the backdoor and the botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology, a device manufacturer based in Shenzhen, China.
According to Google's report, the backdoor, called x.cpe, is preloaded in the firmware's system partition and runs with system-level privileges. If a user removes it, it automatically reinstalls when the device reboots, putting it beyond the reach of ordinary users. Videostrong used obfuscation to slip through Google's compatibility and security testing, loading the malicious code only after a device's first boot so it evaded certification checks. Google said the operators could use the backdoor to capture screens remotely, inject keystrokes, steal account information and device data, silently install other apps without the user's knowledge, and switch off Google's security verification.
Google said Videostrong made money from the backdoor by selling access to the infected devices to criminal affiliates and loading those affiliates' malware modules onto the devices. The modules turned TV boxes in users' homes into exit nodes for residential proxy networks, routing traffic through household broadband connections. They were also used to commit advertising fraud or to load still more malware.
On scale, Google counted more than 1.3 million set-top boxes enrolled in XCPE, spread across more than 200 countries and regions. TrendAI, one of the security firms in the disruption, said it observed more than 1.47 million infected devices across 206 models between June 3 and Oct. 1, 2026. Most victims were Android TV boxes, but the infected devices also included telehealth equipment, karaoke machines and digital signage. Google said that taking down the servers the affiliate groups used to command their modules would also sever the criminals' access to at least 10 million additional compromised devices.
Google said it took legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules, and dismantled the command domains of more than a dozen malware families distributed through the backdoor. Google has cut ties with Videostrong and banned the company, and any future subsidiaries or affiliates, from building and selling certified Android devices or supplying software to other certified vendors. It also said it is improving how it checks the firmware integrity of certified Android TV devices. Lumen, HUMAN Security, Plume and Synthient also took part in the analysis and disruption.
Google's report also noted that from late 2024, Videostrong restructured the backdoor, splitting the malicious modules out of the backdoor itself, a change Google said may have been a response to its earlier enforcement against the related BadBox botnet. The FBI warned in June 2025 that the BADBOX 2.0 botnet had turned millions of home internet-connected devices into residential proxy tools, and Google sued the operators of BADBOX 2.0 the following month.
It should be noted that the attribution to Videostrong is an assessment Google made from its investigation; the allegations have not been adjudicated in court. Videostrong had not publicly responded as of publication. Google's report did not publish a full list of affected device models, and what was dismantled was the servers and domains controlling the backdoor: the backdoor inside devices already sold will not disappear on its own as a result. No public notice on the matter from Chinese regulators has been seen in publicly available information.
(Source: Google Threat Intelligence Group)
Source: Google Threat Intelligence Group
Published by GSM · USA (original Chinese edition)
Photo: 图：一台安卓电视盒与遥控器（资料图，非涉事厂商产品）。照片：Oliwier Jaszczyszyn／kontrabanda.net，CC BY-SA 4.0，经 Wikimedia Commons。 / Photo: An Android TV set-top box and its remote (file photo; not a product of the maker named in this story). Photo by Oliwier Jaszczyszyn / kontrabanda.net, CC BY-SA 4.0, via Wikimedia Commons.
