XCPE Botnet Taken Down: 1.3 Million Android TV Devices Disinfected

A coalition of cybersecurity companies, alongside the National Police Agency of Japan, has successfully neutralized the XCPE backdoor. The massive botnet compromised over 1.3 million Android TV boxes and other devices across more than 200 countries worldwide.

Key facts at a glance: - The XCPE backdoor infected over 1.3 million devices in 200+ countries. - Chinese hardware maker Videostrong Technology is believed to be the creator. - Major tech firms including Google, Lumen, Human Security, Plume, Synthient, and TrendAI joined the operation.

Infection Mechanism and Videostrong Technology's Involvement According to the Google Threat Intelligence Group, the backdoor and botnet were intentionally developed and operated by Videostrong Technology for financial gain. The Shenzhen-based hardware manufacturer embedded the XCPE backdoor directly into the firmware of Android devices and sold access to criminal affiliates. When unsuspecting consumers connected these devices to their home networks, the pre-installed backdoor allowed operators to establish proxy networks and route malicious traffic through residential internet connections without the owners' knowledge or consent.

Technical Details and Scope of the Operation TrendAI reported that the firmware-embedded management agent disguised itself as a standard remote administration client. It downloaded updates from GitHub and connected to an MQTT server, granting operators full remote control over each compromised device. This architecture enabled operators to install or remove apps, alter system settings, and push updates. Between June 3 and October 1, 2026, TrendAI recorded more than 3.8 million unique home and mobile IP addresses associated with this malicious operation.

Industry Impact and Connection to Badbox 2.0 In addition to neutralizing XCPE, the coalition disrupted C2 domains used by affiliate participants, which Google estimates cut off operators from at least 10 million additional compromised devices. Consequently, Google severed all ties with Videostrong Technology and banned the manufacturer from releasing devices with pre-installed Google apps. This distribution network shares ecosystem roots with Badbox 2.0, another prominent botnet that infected over 10 million devices before being dismantled. The coordinated international crackdown highlights the growing effectiveness of joint private-public cybersecurity defenses.