Cops bust botnet of 1.3M infected Android TV boxes

In a joint effort involving several private-sector security firms and Japan’s National Police Agency, authorities have dismantled XCPE, a malicious backdoor that enabled the creation of a massive botnet with over 1.3 million infected Android TV boxes across more than 200 countries. Notable participants in the disruption included Google, Lumen, Human Security, Plume, Synthient, and TrendAI.

Google's Threat Intelligence Group (GTIG) stated with high confidence that Videostrong Technology, a hardware manufacturer based in Shenzhen, China, intentionally developed, deployed, and operated the backdoor for financial gain. Videostrong, specializing in Android devices such as home TV boxes and projectors, embedded the XCPE backdoor in device firmware and sold access to criminal affiliates.

This allowed affiliates to install additional malware modules on devices purchased by unsuspecting customers, creating proxy networks and hiding malicious traffic using customers' internet connections without their knowledge.

The pre-installed management agent, disguised as a standard remote-management client, pulled updates from a GitHub page and connected to an MQTT server, providing operators with complete remote control over each box. This enabled them to install and remove apps, alter settings, and push updates to the compromised devices. Between June 3 and October 1, TrendAI documented over 3.8 million distinct home and mobile IP addresses linked to the operation.

In addition to the disruption of XCPE, the coalition dismantled the command-and-control domains used to manage the affiliate modules. GTIG estimated that severing access to these domains would isolate at least 10 million additional compromised devices. Google subsequently severed ties with Videostrong and banned the OEM from manufacturing devices with preloaded Google apps.

This backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another notorious botnet that infected over 10 million TV boxes and other devices before its disruption in March 2025 by Human, Google, and TrendAI.