Google takes down the XCPE botnet, and says the TV box maker built the backdoor
Google shut down the servers behind XCPE, a botnet of 1.3M+ Android TV boxes, and attributes the backdoor to manufacturer Videostrong. Germany, the US and the UK each count tens of thousands of infected devices.
Translated from the German original with an AI language model, approved by me. Read the original
Usually an attacker plants the backdoor. This time, Google says, it was the manufacturer. In late October 2026, Google took down the servers behind XCPE, a botnet of more than 1.3 million Android devices. Almost all of them are TV set-top boxes.
What happened
XCPE (internally "x.cpe") is a backdoor that ships in the boxes' firmware, the software built into the device. It runs as a system app with full privileges and reports to command-and-control servers, which the operators use to send instructions to the devices. According to Help Net Security, it reinstalls itself from a protected partition after a reboot, so uninstalling the app doesn't get rid of it. To install software silently, XCPE turns off Google Play Protect's app checks.
Google's Threat Intelligence Group attributes XCPE "with high confidence" to Videostrong Technology, a manufacturer based in Shenzhen, China. Videostrong builds Android TV boxes under its own name and for other brands. The Hacker News lists the evidence:
- XCPE passes settings to other Videostrong apps.
- A GitHub account that hosted the botnet's packages is named "yf-videostrong".
- Partner company Synthient found a document signed by Videostrong's R&D director on one of the botnet's servers.
- A Videostrong domain and the operators' control panel shared an IP address.
The reports describe the business model like this: Videostrong sold criminals access to the boxes, and the criminals installed their own modules. Most modules turned the boxes into residential proxies. A residential proxy routes other people's internet traffic through home connections so it looks like ordinary household traffic. Other modules loaded ads in the background that nobody saw, which is ad fraud. The operators could also take screenshots, inject keystrokes, copy account details and system logs, and open a remote shell.
What Google did
Google took legal action against the domains and servers that controlled the botnet. The action also covered the control infrastructure of more than a dozen other malware families. Japan's National Police Agency took part, along with Lumen, HUMAN Security, Plume, Synthient and TrendAI, Trend Micro's enterprise unit. Videostrong and any future subsidiaries are now banned from building certified Android devices and from supplying software to certified manufacturers. Google is also tightening firmware checks for certified Android TV devices and has closed a gap in its manufacturer review process.
What has changed since my post
In my post I said it was unclear how far XCPE had spread in Germany. There are numbers now. According to The Hacker News, Malaysia, Brazil, Iraq, Mexico and Taiwan had the most infections. The US, Germany, the UK, Australia and Canada each had roughly 26,000 to 42,000 devices. Between June and October, TrendAI counted 1,472,554 infected devices across 206 models, more than Google's 1.3 million. MECOOL boxes come up most often among the brands. Synthient has published a list of 182 model names, but a model name alone doesn't prove a device is infected. According to Plume, the botnet included both Google-certified devices and boxes running plain AOSP, the open-source Android without Google services. The backdoor also showed up in telehealth devices, karaoke machines and digital signage.
Google expects the takedown to cut criminals off from at least 10 million more devices that were infected in other ways.
What you should do
As far as anyone has reported, there is no patch. The servers are down, but the backdoor is still in the firmware, so whoever controls it could put the devices back to work.
- Check your box: Do you have a cheap Android TV box, especially a MECOOL or no-name brand? Compare the model against Synthient's list.
- Replace it if in doubt: Synthient advises throwing affected boxes away. Plume recommends at least a full factory reset but doesn't say whether that removes XCPE. TrendAI says getting rid of the backdoor takes action from the vendor, platform protection or a new device. My take: a factory reset probably isn't enough here. The box should go.
- Segment your network: TV boxes and other IoT devices belong on their own network, such as a guest Wi-Fi or a VLAN, kept apart from computers and NAS devices.
- For organizations: Hunt for these devices using the published indicators, block the listed control domains, and treat unmanaged personal devices in home offices as part of your attack surface.
My advice stands: with a $30 box from a brand nobody's heard of, you may end up paying with your internet connection.