Cops bust botnet of 1.3M infected Android TV boxes
Videostrong accused of shipping devices with a backdoor baked in
A coalition of private-sector security firms, including Google, Lumen, Human Security, Plume, Synthient, and TrendAI, has dismantled XCPE, a malicious backdoor used to create a vast botnet of over 1.3 million Android devices in more than 200 countries. The joint effort, led by Google's Threat Intelligence Group (GTIG), concluded that Videostrong Technology, a Shenzhen-based hardware manufacturer, intentionally developed and operated the backdoor for financial gain.
Videostrong embedded XCPE in device firmware and sold access to criminal affiliates, who then installed additional malware on unsuspecting customers' devices. Connected to home networks, the backdoor enabled operators to establish proxy networks and conceal malicious traffic using customers' internet connections without their knowledge.
The firmware included a pre-installed management agent designed as a standard remote-management client, pulling updates from a GitHub page and connecting to an MQTT server that granted full remote control of each box. Between June 3 and October 1, the coalition monitored over 3.8 million distinct IP addresses linked to the operation.
Moreover, the disruption of XCPE's command-and-control domains is expected to sever access to at least 10 million additional compromised devices, as affiliates have diversified distribution channels beyond XCPE. Google canceled its partnership with Videostrong and barred the company from producing devices with preloaded Google apps.
This botnet and backdoor operation is part of the same ecosystem as BadBox 2.0, a notorious botnet that infected over 10 million TV boxes and other devices before its disruption in March 2025.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.