TV boxes shipped with a backdoor: Google takes down the 1.3-million-device XCPE botnet and permanently bans the manufacturer
Google disclosed and dismantled the XCPE botnet on November 2: Videostrong preinstalled a backdoor at the factory, more than 1.3 million TV boxes were controlled, and severing the network is not the same as removing the malware — the backdoor remains in device firmware.
- 01THE ANNOUNCEMENT — Google's Threat Intelligence Team published its post on November 2, disclosing the XCPE backdoor and the attribution to Videostrong.
- 02THE CONFIRMATION — Independent reports by The Register and BleepingComputer checked the scale, attribution and countermeasures and found them consistent.
- 03THE WATCHPOINT — Whether a list of affected device models and a firmware clean-up plan are published, and whether the certification testing changes are implemented.
WHAT HAPPENEDWhat Happened
Google's Threat Intelligence Team wrote on November 2 that, together with partners last week, it had taken down the XCPE backdoor network: more than 1.3 million set-top boxes had been enrolled in the botnet, the vast majority of them Android TV boxes, spread across more than 200 countries and regions.
Google assesses with high confidence that the backdoor and botnet were deliberately developed, deployed and operated for profit by Videostrong Technology, an Android contract manufacturer and design firm — not the act of a rogue individual, and not a development oversight.
The backdoor itself, x.cpe (in some versions com.oemservice), is preinstalled with system privileges in the firmware partition; if a user deletes it, it automatically reinstalls from the /oem/ partition on reboot. It first disables Play Protect, then receives commands over an MQTT persistent connection — silently installing apps, capturing screenshots, injecting key presses and harvesting data.
Monetisation came from renting the devices to criminal groups: a proxy module turned users' broadband into residential proxy exits, an ad-fraud module farmed impressions and clicks, and further backdoor modules such as Moyu and Spirit installed still more malware.
Google's response included legal action to take down Videostrong's control domains and servers, taking down the control domains of more than a dozen affiliated malware families, permanently barring Videostrong and any future affiliates from producing certified Android devices or supplying software to certified manufacturers, and tightening firmware-integrity checks for certified devices.
Partners included Japan's National Police Agency and Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google assesses that once the control domains of the affiliated modules are cut, at least 10 million devices infected through other channels will also lose their control channel.
WHY IT MATTERSA certification badge cannot stop a backdoor installed at the factory
The key difference between XCPE and earlier TV-box botnets is its origin: it was not a user-installed rogue app, nor grey-market output from uncertified off-brand devices, but certified hardware that had passed Google's compatibility and security testing, shipped with a backdoor from the factory. The manufacturer used obfuscation to slip through gaps in testing, loading the malicious code only after first boot.
That means looking for the certification mark when buying a box is no longer enough. The line of defence against supply-chain attacks has moved from the app store to factory firmware; ordinary users have almost no means of checking for themselves, and responsibility for remediation falls on manufacturer bans and firmware updates.
WHY IT MATTERSSevering the network is a victory; the clean-up has not begun
Google's action cut the control channel but did not remove the backdoor from a single device. As long as a device stays online with its firmware unchanged, the attackers can return with a fresh set of control domains. The 1.3 million figure describes the size of the network, not the number repaired.
For ordinary users, only two practical options remain: flash the box with clean firmware, or take it offline. Anyone who has bought a device contract-manufactured by Videostrong should first check whether their brand and model are in scope, rather than wait for a system prompt.
SIGNAL JUDGMENT — ANALYSISWatch the supply chain, not the box count
Tokenta Signal's judgment: XCPE's signal is not the 1.3 million figure but the first frontal breach of the certification system by a factory-installed backdoor. With the defensive line moved behind the factory gate, the old habit of trusting brands and certification marks when buying devices no longer suffices. The next signal is whether Google's firmware-integrity changes can stop the next Videostrong.
WHAT REMAINS UNCERTAINWhat Remains Uncertain
EVIDENCEEvidence
Confirmed by two sources, the Google Threat Intelligence Team's official blog and The Register's report; the original link was opened and verified.
PRIMARY SOURCESPrimary Sources
- Google Threat Intelligence Team Official Blog
https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet - The Register Independent Report
https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045
RELATEDRelated Intelligence
- Microsoft Winds Down Its Oracle AI Cloud Rental as Older Nvidia Chips Fall Behind
- An Unreleased Anthropic Model Proved an 18-Year-Old Quantum Conjecture, Machine-Checked in Lean
- IBM Unveils Quantum System Two in Chicago, Its Most Advanced Computer Yet, Powered by Nighthawk
- Vistra Posts $1.14B Q3 Profit as Power EBITDA Jumps Over 50%, Lifts 2026 Outlook