🔍 Read the full analysis: The Story Behind Google’s Takedown Of A TV Box Botnet on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said it and industry partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes. Google accuses manufacturer Videostrong Technology of embedding and operating the backdoor for profit; the company’s response is not included in the available reporting. The takedown cuts off remote control, but the backdoor remains in affected firmware and may return after a reboot.
Google and industry partners disrupted the control infrastructure of XCPE, a botnet linked to more than 1.3 million set-top boxes, the company said on November 2. Google alleges that Shenzhen-based device maker Videostrong Technology built and operated a backdoor in the boxes for financial gain, a claim that could affect owners of inexpensive Android TV devices as well as businesses that rely on residential internet connections.
Google’s Threat Intelligence Group said it worked with Japan’s National Police Agency and security firms to take action against the botnet’s control servers and domains in late October. The partners named in Google’s report include Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google also said it pursued action against control servers associated with more than a dozen malware families distributed as add-ons to infected devices.
The reported scale varies by source and counting method. Google described XCPE as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and characterized that figure as a lower bound. Those figures are not a measure of how many devices remain active after the disruption.
According to Google, the boxes could be used as residential proxies, routing other people’s internet traffic through a household’s connection, and for ad fraud. The company also reported capabilities that included taking screenshots, recording keystrokes, collecting account and device information, and opening remote command shells. Google said Videostrong and its future subsidiaries or affiliates are barred from making certified Android devices or supplying software to certified vendors, and that it has tightened firmware-integrity checks.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Risks for TV Box Owners
The alleged method changes the usual advice for dealing with malware. If the backdoor was installed in a device’s firmware before sale, avoiding suspicious links or uninstalling an app may not be enough. Google says the relevant system app can return from a protected partition after a reboot, so the botnet disruption does not, on its own, clean an affected box.
Residential proxy activity can also make a household’s connection appear to be the source of traffic it did not generate. That may create security, service or reputational problems for owners, although the source material does not establish specific harms to individual households. For organizations, the report is a reminder that connected devices on home and office networks can be part of an attack surface, and that an IP address’s past reputation does not by itself establish who is using it.
Google estimates that shutting down control servers for related add-on malware could cut access to at least 10 million additional compromised devices. That is Google’s estimate, not a confirmed count of devices reached by the action; the source reporting also says not all of those devices run Android.
Products Worth Considering
Samsung 27-Inch Odyssey OLED G5 QHD Gaming Monitor
Samsung 27-inch Odyssey G5 QHD Gaming Monitor (G51F)
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
Google’s November 2 report, titled “Shutting the Door on the XCPE Botnet,” describes a small system app identified in some builds as x.cpe and in others as com.oemservice. According to the company, it was embedded in firmware with system-level privileges. When a box started, the app contacted a control server for instructions and could enable operators to install additional software or issue commands remotely.
Google says the app could reinstall itself from a protected partition if removed, and that the operators disabled Google Play Protect app checks before installing other software. The company describes a design with separate components for contacting the server, loading software and running revenue-generating modules. It says new droppers disguised as Android system apps appeared in August 2026.
Some affected devices were Google-certified Android TV devices, according to Google. The company said Videostrong used obfuscation to get malicious code past its review process by loading it after a device’s first boot. Google’s reported response includes a ban on the manufacturer from its certified-device program and changes to firmware checks. The source material says the company did not respond to comment requests from The Record and heise; it does not provide a direct response from Videostrong.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The disruption targeted control servers and domains; it did not establish that the malicious firmware was removed from affected boxes. Google’s report says the backdoor can reinstall after a reboot, and the available source material says uninstalling the app will not remove it. The extent to which operators can still reach devices through other infrastructure is not clear from the reporting provided.
The source material does not include a public court filing, case number or court, and it does not report a response from Videostrong. The precise number of devices still infected, the number that were actively communicating with the botnet at the time of the disruption, and the number of owners directly affected remain unknown. Google’s estimate of at least 10 million additional devices is an estimate involving related malware, not a confirmed count of XCPE boxes.
Steps for Owners and Google
Google says it has changed its review process for certified Android TV firmware and barred Videostrong and future affiliates from supplying certified devices or software. The source material does not give a schedule for further enforcement or describe a firmware update that removes the backdoor from devices already sold.
Owners can check whether a box is Play Protect certified and be cautious about no-name or “unlocked” devices. Because Google says uninstalling the system app may not work, people who suspect their device is affected can treat it as untrusted: disconnect or replace it, and keep TV boxes on a separate guest network where possible. Businesses should review connected devices on their networks rather than relying only on IP reputation when evaluating traffic.
Key Questions
What happened to the XCPE botnet?
Google said it and industry partners disrupted XCPE’s control infrastructure in late October 2026. Google described the botnet as involving more than 1.3 million set-top boxes.
Who does Google say was behind the backdoor?
Google alleges that Videostrong Technology, a device manufacturer, built and operated the backdoor for financial gain. The source material does not include a response from Videostrong or a public court finding.
Does the takedown remove malware from an infected TV box?
Not necessarily. The action targeted servers and domains used to control the botnet. Google says the backdoor remains in firmware and can reinstall after a reboot, so removing an app may not clean the device.
How many devices were affected?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called its count a lower bound. The figures use different descriptions and do not establish how many devices remain infected now.
What should TV box owners do?
Check the box’s Play Protect certification, be cautious about unfamiliar or “unlocked” devices, and consider disconnecting or replacing a box suspected of infection. Google’s account says uninstalling the app alone may not remove the firmware backdoor. A separate guest network can limit a device’s access to other equipment.
Source: ThorstenMeyerAI.com
