Google Disrupts XCPE Malware Botnet and Bans TV Box Maker
Google and international partners have dismantled a massive Android TV botnet consisting of over 1.3 million streaming boxes infected at the manufacturing stage.
Radwan AbdulhadiEditor and technology writer
Dismantling the XCPE Botnet
Google and various industry partners have successfully dismantled a massive malware botnet known as XCPE, which compromised more than 1.3 million Android TV streaming boxes. According to a detailed technical breakdown by <a href="https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet">Google's Threat Intelligence Group (GTIG) said</a>, the device manufacturer intentionally integrated persistent backdoors into the hardware to generate revenue through illicit cybercrime activities.
Investigators attributed the expansive botnet with high confidence to the Chinese device manufacturer Videostrong Technology Co. The company is accused of deliberately deploying the backdoor into hardware it manufactured and commercializing access to criminal affiliates.
Manufacturer Involvement and Attribution
Evidence uncovered during the investigation indicated that the malicious software was built straight into various device models and brands across multiple years. Security researchers and investigators found that Videostrong maintained dedicated infrastructure and constantly evolving configurations designed to evade detection while managing its network of criminal affiliates.
A <a href="https://synthient.com/blog/the-internals-of-a-badbox-operation">separate coordinated report</a> published by cybersecurity firm Synthient further traced the backdoor infrastructure back to Videostrong. Researchers discovered the malware preinstalled on a streaming device purchased late last year, alongside exposed directories containing documentation linked directly to the manufacturer's research and development director.
Malware Architecture and Capabilities
Unlike traditional botnets that infiltrate consumer hardware via software vulnerabilities or user deception, the XCPE botnet was embedded directly into device firmware during the manufacturing process. The primary backdoor components, tracked under specific system identifiers, operated with Android system-level privileges to ensure persistence and deep access.
Once an infected streaming box booted up, the malware communicated with command-and-control servers to obtain connection credentials for an MQTT message broker. This setup enabled operators to remotely execute shell commands, capture screenshots, inject keystrokes, and install additional software without user consent.
Monetization and Criminal Operations
The compromised hardware acted as a plug-in cybercrime platform for various third-party operators. Affiliates utilized the infected devices to run residential proxy services—such as Linkfog, NetNut, and Traffmonetizer—routing unauthorized internet traffic through consumer networks.
In addition to proxy traffic, the network executed widespread ad fraud by generating fake ad impressions, loading hidden web pages, and simulating clicks. Other modules deployed secondary backdoors to further expand the operational scope of the compromised hardware.
Google Countermeasures and Sanctions
As part of the coordinated disruption effort, Google took down command-and-control servers associated with more than a dozen related malware families, cutting off access to millions of additional compromised devices globally. Furthermore, Google terminated its relationship with Videostrong, revoked its manufacturing licenses, and banned the company and its affiliates from supplying software to certified vendors.
While the takedown successfully disrupted active command infrastructure, the malware remains embedded within the device partitions of infected units. Affected users face challenges because the software automatically reinstalls itself from the system partition, meaning that complete remediation requires flashing clean firmware or disconnecting the device from the internet entirely.
Sources
- BleepingComputerGoogle disrupts million-device XCPE Android malware botnet, bans TV box maker
Continue chronologically
Related entity coverage
Related stories
Google Cuts Ties After Partner Turns 1.3M Devices Into Botnet
Google dismantles a covert backdoor built by an Android partner, which turned 1.3 million set-top boxes and IoT devices into an active financial botnet.
Google shuts down malware backdoor on Android TV boxes
Google has cut ties with device maker Videostrong after discovering a malware backdoor on certified Android TV and Google TV boxes.
Google Dismantles XCPE Botnet of 1.3 Million Android Devices
Google has dismantled the 1.3 million-strong XCPE botnet created by Videostrong Technology, banning the OEM from preloading Google apps.
Next-Gen Google TV Streamer in Development With Built-In Mics
Google is reportedly developing a next-generation Google TV Streamer featuring built-in microphones, presence sensing, and a new remote control.
