---
title: Google takes down the XCPE botnet: 1.3 million Android TV boxes backdoored at the factory by maker Videostrong, which sold access to ad-fraud and residential-proxy crews | ctxsec
url: https://ctxsec.com/items/google-xcpe-botnet-videostrong-android-tv-boxes-disrupted-nov-2
description: "Google's Threat Intelligence Group says it and partners dismantled the XCPE backdoor last week. Google assesses with high confidence that Shenzhen device maker Videostrong built and ran the backdoor for profit, loading affiliates' ad-fraud and residential-proxy modules onto more than 1.3 million set-top boxes. Google used legal action to seize the botnet's domains and servers plus C2 domains for over a dozen affiliate malware families, which it expects to cut access to at least 10 million more infected devices, and banned Videostrong from certified Android. The backdoor itself stays on the boxes."
status: "official (Google Threat Intelligence Group blog, Nov 2; partner reports from TrendAI and Synthient)"
published: 2026-11-02
---

> Google's Threat Intelligence Group says it and partners dismantled the XCPE backdoor last week. Google assesses with high confidence that Shenzhen device maker Videostrong built and ran the backdoor for profit, loading affiliates' ad-fraud and residential-proxy modules onto more than 1.3 million set-top boxes. Google used legal action to seize the botnet's domains and servers plus C2 domains for over a dozen affiliate malware families, which it expects to cut access to at least 10 million more infected devices, and banned Videostrong from certified Android. The backdoor itself stays on the boxes.

[← Cybersecurity News](/news) · [markdown](/items/google-xcpe-botnet-videostrong-android-tv-boxes-disrupted-nov-2.md)

official (Google Threat Intelligence Group blog, Nov 2; partner reports from TrendAI and Synthient)

2026-11-02

### Google takes down the XCPE botnet: 1.3 million Android TV boxes backdoored at the factory by maker Videostrong, which sold access to ad-fraud and residential-proxy crews

Google Threat Intelligence Group (GTIG) published the takedown on **Nov 2**. Partners were Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

- **Who:** Google assesses with high confidence that **Videostrong Technology Co.**, an Android OEM/ODM, intentionally developed and operated the backdoor and sold access to criminal affiliates. Google says it was not a rogue insider or an oversight, and that Videostrong used obfuscation to load malicious code after first boot, slipping past Android certification tests.
- **How it works:** a stub (`x.cpe`, `com.oemservice` in some builds) is preloaded in the firmware at `android.uid.system` privilege and reinstalls itself from `/oem/` if removed. It fetches config over HTTP, then takes orders over MQTT: silent app installs (after disabling Play Protect verification), shell commands as the system user, screen capture, keystroke injection and network reconnaissance. Modules turned devices into residential-proxy exit nodes and ad-fraud engines or loaded further backdoors.
- **Action taken:** legal takedown of Videostrong's C2 and staging domains and servers, and of C2 domains for over a dozen affiliate malware families; Google expects the affiliate takedown to sever access to at least **10 million** additional compromised devices. Videostrong and any future affiliates are banned from certified Android.
- **Scale:** TrendAI counted 1,472,554 infected devices across 206 models between Jun 3 and Oct 1. Mostly TV boxes, but also telehealth devices, karaoke machines and digital signage.

**What to do:** owners cannot remove a firmware backdoor themselves. Treat no-name Android TV boxes, especially MECOOL-branded ones Synthient ties to Videostrong, as untrusted: take them off networks that hold anything sensitive, or replace them with Play Protect certified devices. Synthient publishes a list of 182 model names seen in the campaign but notes a model name alone does not prove infection. Network indicators and detection ideas are in the companion hunting item.

Sources: [Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet (Nov 2)](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/) · [TrendAI: research helps disrupt Android TV botnet of more than 1.3 million pre-infected devices](https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/trendaitm-research-helps-disrupt-android-tv-botnet-of-more-than-13-million-pre-infected-devices) · [Synthient: The internals of a BADBOX operation](https://synthient.com/blog/the-internals-of-a-badbox-operation) · [Synthient public research: Videostrong model list (GitHub)](https://github.com/synthient/public-research/blob/main/2026/11/Videostrong/README.md) · [The Hacker News (Nov 2)](https://thehackernews.com/2026/11/google-disrupts-13-million-device.html)