Google said on November 2 that it has dismantled a backdoor that turned more than 1.3 million television set-top boxes into a botnet, and it has cut ties with the manufacturer it blames. The company assessed with high confidence that Shenzhen-based Videostrong Technology deliberately built, deployed and operated the XCPE backdoor for financial gain, then banned Videostrong and its future affiliates from making certified Android devices.
A backdoor built in, not broken in
Unlike most botnets, XCPE did not arrive through a phishing link or a software flaw. Google said the malware was preloaded in device firmware during manufacturing, running with system-level privileges, and it reinstalled itself from a protected partition whenever a user removed it and rebooted. That persistence made ordinary cleanup useless.
The backdoor’s main job was communication, not theft. It contacted a command server, then held a persistent messaging connection through which operators could install apps silently, disable Google Play Protect, run shell commands, capture screenshots, inject keystrokes and collect account and device data. Google said operators used those powers to serve criminal affiliates, not to spy for one master.
A rental business for criminals
Videostrong monetized the backdoor by selling access to criminal affiliates, Google said, and those affiliates loaded their own money-making modules onto infected devices. Some turned boxes into residential proxy nodes that routed other people’s internet traffic. Others committed advertising fraud with hidden pages and fake clicks, while further modules installed still more malware on machines already compromised.
The scale reached far beyond the boxes themselves. Google said the takedown disrupted command domains used by more than a dozen affiliate malware families, and it estimated that step would sever criminal access to at least 10 million additional compromised devices. Those devices were infected through other channels, and the figure estimates access lost, not machines cleaned.
How investigators tied it to Videostrong
Google said the campaign was not a rogue insider or a development oversight. Security firm Synthient traced the backdoor after finding it on a MECOOL box bought in late 2025, then found company email addresses used to sign backdoors, a company document on a malware server, and a shared address linking Videostrong’s domain to the command server.
Videostrong has not responded to the attribution, and no court has ruled on it, so the blame remains Google’s assessed finding rather than a legal verdict. What is not in dispute is the remedy: legal action against the control servers, a ban covering future subsidiaries and affiliates, tighter firmware checks for certified Android TV devices, and a changed review process.
Our read
The lesson is that certification failed at the factory, not at the app store. Google’s tests were supposed to guarantee a certified box was safe, yet obfuscation and a first-boot payload slipped through, and the malware lived in homes for years across many brands. That makes this a supply-chain story, and it explains why Google’s response reaches beyond one company.
Owners face an awkward truth: the takedown cut the strings, but it did not clean the puppets. Google said the malware reinstalls itself after removal, so owners must install clean firmware or disconnect the device, and Google has published no full list of affected brands.
The same trust gap showed when hundreds of ordinary-looking apps hid deepfake tools behind store listings, and both cases carry one lesson for buyers: treat a certification badge or a store listing as a starting point, not a guarantee, and be wary of cheap boxes sold under unfamiliar brands.
Why It Matters
A botnet that ships inside the product breaks the usual advice about safe downloads, because there was nothing for the owner to avoid clicking. It also hands criminals a foothold in home networks, where the same boxes sit beside routers and telehealth devices.
Britain’s cyber agency has warned that AI-powered attacks on critical infrastructure are growing, and XCPE shows how cheap, trusted hardware can join that attack surface. For manufacturers, the message is sharper still: a certification badge is now a liability if the factory behind it cannot be trusted.
Background
The XCPE disruption follows the BadBox pattern: a botnet that infected more than 10 million boxes before its March 2025 disruption, monetized by affiliates, and fought by targeting control servers rather than devices. The difference this time is the direct accusation against a named manufacturer for building the backdoor itself.
Source: Google threat intelligence post and full security report
0 Comments