Google Dismantles XCPE Botnet Infecting 1.3 Million Android TV Devices
Google and its industry partners have dismantled the XCPE botnet, which enrolled more than 1.3 million set-top boxes, most of them Android TV devices. Google’s Threat Intelligence Group said it had high confidence that Videostrong Technology, an Android device manufacturer, deliberately developed and operated the network for financial gain. The malware was embedded in device firmware before the products reached consumers, allowing them to join the network without buyers’ knowledge.
The operation, announced on 2 November, involved Google, Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google took legal action to disrupt the domains and servers used to control the botnet and install malicious software, as well as command-and-control domains linked to more than a dozen malware families distributed through the network.
How the XCPE botnet reached Android TV devices
Google said the backdoor, known as x.cpe or com.oemservice in some versions, was placed in the firmware partition and operated with system-level privileges. Videostrong used obfuscation to load malicious code after a device’s first boot, exploiting a gap in Google’s certification checks. This allowed the malware to evade initial security testing, including on devices certified to use Google apps.
Once a compromised box connected to the internet, the backdoor could receive instructions from remote servers to install additional modules. Investigators found the malware across different brands and models. Android TV boxes made up most infected devices, but Google also identified compromised telehealth devices, karaoke machines and digital signage systems.
What the infected devices were used for
Google identified several ways the network was monetised. Infected devices were silently enrolled in residential proxy networks, allowing outside parties to route internet traffic through consumers’ home connections. Other modules carried out advertising fraud, collected sensitive information or installed further malware. Google also observed operators capturing screenshots, injecting keystrokes and executing commands on compromised devices.
The proxy activity is concerning because malicious traffic can appear to originate from an ordinary household internet connection. A home IP address may therefore become associated with activity the owner did not initiate, while device and network information can be exposed to remote operators.
Google’s coordinated takedown disrupted the network
Google took legal action to disable the infrastructure Videostrong used to control the XCPE botnet and install malware modules. It also disrupted command-and-control domains used by more than a dozen affiliate malware families. Google estimates this second action could sever access to at least 10 million additional compromised devices, although those devices were not all part of the XCPE network.
The operation involved several technology and security organisations, alongside Japan’s National Police Agency. Their work combined threat intelligence, network analysis and infrastructure disruption. Google said it is also changing its firmware integrity checks and manufacturer review process to address the technique used to evade certification.
Videostrong loses access to certified Android devices
Google has cut ties with Videostrong and banned the company, including future subsidiaries and affiliates, from making certified Android devices or supplying software to other certified vendors. The decision follows Google's assessment that the campaign was a deliberate operation rather than the work of a rogue employee or an accidental security flaw.
However, disabling the control infrastructure does not necessarily remove the backdoor from devices already sold. Google has not said that all affected boxes have received clean firmware. Security researchers have warned that the implant may remain even after the current command-and-control servers are disabled.
What affected device owners should know
Owners of Android TV boxes from unfamiliar manufacturers should check whether their model appears on security researchers’ lists of affected devices and contact the seller for guidance. If a device is suspected to be compromised, disconnecting it from the internet is a prudent precaution while seeking clean firmware or a replacement.
The incident highlights the risks of buying connected devices from unknown suppliers, particularly when malware can be embedded before sale. It also raises questions about how manufacturers and certification programmes verify firmware integrity after a device's initial setup.
