---
title: "Google Dismantles XCPE Botnet of 1.3M TV Boxes: Malware Hardcoded into Factory Firmware"
description: "Google and partners have neutralized the XCPE botnet consisting of over 1.3 million Android TV boxes, into which manufacturer Videostrong allegedly hardcoded a backdoor at the factory."
date: 2026-11-04T03:02:00.248Z
lang: en
url: https://xab.info/en/posts/google-dismantles-xcpe-tv-boxes-botnet
tags: [google, botnet, android-tv, cybersecurity, videostrong, tv-boxes]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Google Dismantles XCPE Botnet of 1.3M TV Boxes: Malware Hardcoded into Factory Firmware

![person holding a remote control in hand against the background of a TV screen](https://xab.info/media/2026/11/04/google-likvidirovala-botnet-xcpe-tv-pristavok/google-likvidirovala-botnet-xcpe-tv-pristavok-1.webp)

## Key Points

- Google, with partner support, neutralized the XCPE botnet of over 1.3 million Android TV boxes
- Malware was embedded into the firmware during manufacturing rather than via software vulnerabilities
- Google links the botnet with high probability to Chinese manufacturer Videostrong Technology
- Google revoked Videostrong's Android TV licensing and banned it from certifying Android products
- Infected devices were used for proxy networks, ad fraud, and downloading additional malware

Google, together with a number of cybersecurity partners and law enforcement agencies, has neutralized a botnet named XCPE, which comprised over 1.3 million Android-powered TV boxes. According to the search giant, the devices were not infected through software vulnerabilities, but rather at the manufacturing stage: the manufacturer intentionally embedded a hidden remote access channel — a backdoor — into the firmware and subsequently sold the ability to control the compromised devices to malicious actors. Google links the botnet infrastructure with a high degree of probability to Chinese electronics manufacturer Videostrong Technology, which the company accuses of distributing malicious code in devices of various brands and models for years.

### Firmware Backdoor and Modular Architecture

A key feature of XCPE was its integration directly into the device firmware at the factory, eliminating the classic vulnerability exploitation scenario. The main component of the backdoor operated with Android system privileges, giving operators full control over the device. The malware's architecture was modular: backdoor functions were separated from modules designed to generate revenue for third-party partners. Once an infected set-top box was powered on, the XCPE component contacted a command server, received connection data and credentials for an MQTT message broker, through which operators remotely controlled the devices and triggered malicious actions. To evade detection, the attackers constantly changed the program structure: in late 2024, according to Google, Videostrong switched to a separate loader to run modules, and in August separated this function into more compact specialized droppers disguised as Android system applications.

### What the Infected Devices Were Used For

Compromised set-top boxes were used for several types of cybercriminal activity. Some modules were linked to residential proxy services — Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer — which redirected third-party internet traffic through infected devices without the knowledge and consent of their owners. Other modules were used in ad fraud schemes: generating impressions, loading hidden web pages, and simulating ad clicks. The backdoor also downloaded additional malware — Moyu, Spirit, and Bird — to deliver and run more expensive payloads. Thus, the backdoor effectively acted as a platform where third-party criminal groups hosted their own modules.

### How the Botnet Was Linked to Videostrong

The connection between the XCPE backdoor and Videostrong was established by Synthient. According to their data, in late 2025, malware was discovered on a newly purchased Mecool KM9PRO Max Android TV box. Specialists found a public directory containing backdoors, which included a folder with a PDF file authored by Videostrong's Director of Research and Development, Owen Cao. This made it possible to attribute the infrastructure to a specific manufacturer. In addition to Google, the neutralization operation involved the Japanese National Police Agency, as well as Lumen, Human Security, Plume, Synthient, and TrendAI, who jointly analyzed the malicious infrastructure and shut it down.

### Google's Response and Consequences for the Manufacturer

In response to the discovered violation, Google severed ties with Videostrong: the company revoked the manufacturer's license to release Android TV devices with pre-installed Google applications and services, and banned the company and its affiliates from releasing certified Android devices or supplying software to certified manufacturers. According to Google, Videostrong distributed malware for several years, constantly improving the backdoor's functionality to avoid detection and satisfy the requests of various criminal groups.

### Risk for Users

The issue has affected users globally: Google noted several regions where infected devices are present. Videostrong devices are sold on popular marketplaces — both with delivery from China and through local vendors. This means that the risk of purchasing an already compromised set-top box remains, even though the botnet has been officially neutralized, as previously manufactured devices may continue to function as part of the malicious infrastructure until completely shut down by the operators.

## Fact-Check & Sources

- [Google накрыла ботнет из миллионов ТВ-приставок — заражённые с завода устройства продаются и в России window-new](https://3dnews.ru/1150773/google-nakrila-botnet-iz-millionov-tvpristavok-zaragyonnie-s-zavoda-ustroystva-prodayutsya-i-v-rossii) - Primary source: botnet volume (1.3+ million), firmware embedding mechanism, modular architecture, MQTT, proxy services, ad fraud, Google's response, Synthient and law enforcement participation.
- [Google накрыла ботнет из миллионов ТВ-приставок](https://www.kv.by/news/1072590-google-nakryla-botnet-iz-millionov-tv-pristavok) - Matches on key facts: 1.3 million set-top boxes, backdoor, connection to Videostrong, license revocation, operation participation. No discrepancies with the primary source were found.

## FAQ

### What is the XCPE botnet and how many devices did it include?

XCPE is a botnet of over 1.3 million Android TV boxes. According to Google, the malware was built into the device firmware during manufacturing, allowing operators to remotely control the set-top boxes.

### How were the devices infected?

Not through software vulnerabilities, but via a backdoor hardcoded into the factory firmware. The main component operated with Android system privileges, and commands were transmitted via an MQTT message broker.

### What were the infected set-top boxes used for?

They were used for residential proxy networks, ad fraud (generating impressions and simulating clicks), and downloading additional malware such as Moyu, Spirit, and Bird.

### What measures did Google take against Videostrong?

Google revoked the company's license to release Android TV devices with pre-installed Google services and banned it and its affiliates from releasing certified Android devices or supplying software to certified manufacturers.