FHN 
Google and its cybersecurity partners have disrupted a massive Android botnet involving more than 1.3 million devices, primarily Android TV set-top boxes. The investigation revealed that Chinese device manufacturer Videostrong allegedly embedded a backdoor into multiple device models and sold access to cybercriminals.
The operation, announced on November 2, 2026, targeted the XCPE botnet, which allowed attackers to remotely control infected devices and use them for various criminal activities.
How the XCPE Botnet Worked
The x.cpe backdoor operated as a system application with elevated privileges, allowing attackers to remotely control infected devices.
Through the malware, operators could:
- Install applications without users’ knowledge.
- Disable Google Play Protect.
- Execute remote commands and capture screenshots.
- Collect account details, device information and system logs.
- Turn infected devices into residential proxies.
- Generate fraudulent advertising traffic.
Although most affected devices were Android TV boxes, the backdoor was also identified in telehealth equipment, karaoke machines and digital signage devices.
Google Takes Action Against Videostrong
Google used legal action to shut down domains and servers responsible for controlling the XCPE botnet and distributing additional malware modules.
The operation involved Japan’s National Police Agency and cybersecurity organizations including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google also banned Videostrong and its future subsidiaries or affiliates from manufacturing certified Android devices or supplying software to other certified manufacturers.
The disruption is expected to cut off criminal access to at least 10 million additional compromised devices associated with other malware families.
Infected Devices Remain at Risk
The backdoor is embedded in device firmware and can reinstall itself after a restart. Consequently, simply deleting the malicious application may not permanently remove the infection.
Synthient has published a list of 182 device model names identified during its investigation, although a model appearing on the list does not automatically confirm infection.
Organizations are advised to identify potentially affected devices, block associated malicious infrastructure and isolate unmanaged smart devices from sensitive corporate networks.
Google has also modified its Android device certification review process to strengthen firmware security checks and prevent similar techniques from bypassing testing.
About the Author
