# Global Coalition Dismantles Massive Android TV Box Botnet Security firms and Japanese police neutralize XCPE backdoor affecting 1.3 million devices. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-11-02 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/6dc86c3c-9fe2-4f36-baf3-d08c4800a08e ## Botnet Infrastructure Disruption A coalition including Google, Lumen, and the Japanese National Police Agency successfully disrupted the XCPE backdoor. This operation targeted a massive botnet spanning over 1.3 million Android devices across 200 countries. The infrastructure relied on pre-installed firmware backdoors, allowing unauthorized remote control of home TV boxes and projectors globally. ## Manufacturer Involvement Identified Google Threat Intelligence Group identified Shenzhen-based hardware manufacturer Videostrong Technology as the primary developer. The firm allegedly embedded the XCPE backdoor directly into device firmware before shipping. By selling access to criminal affiliates, the manufacturer enabled the installation of malicious modules on devices purchased by unsuspecting home consumers worldwide. ## Technical Execution Mechanism The firmware utilized a management agent disguised as a standard remote-client tool. It communicated via an MQTT server to receive commands, enabling operators to modify settings or install apps remotely. This setup allowed attackers to route malicious traffic through residential internet connections, effectively masking their activities behind legitimate user IP addresses. ## Scale of Network Activity Between June 3 and October 1, TrendAI recorded over 3.8 million distinct home and mobile IP addresses interacting with the operation. The coalition targeted command-and-control domains to sever these connections. Analysts estimate this intervention will disrupt access to at least 10 million additional compromised devices linked to the same criminal affiliate network. ## Google Enforcement Actions Following the investigation, Google terminated its business relationship with Videostrong Technology. The company has officially banned the OEM from manufacturing devices that include preloaded Google applications. This move serves as a significant punitive measure against the hardware provider for its role in facilitating large-scale, unauthorized remote access to consumer hardware. ## Connection to BadBox Ecosystem This incident is classified as part of the same ecosystem as the BadBox 2.0 operation. That previous campaign compromised over 10 million TV boxes and various other hardware units. The coalition, including Human Security and TrendAI, had previously disrupted that specific botnet in March 2025, highlighting a recurring pattern of firmware-level threats. ## Operational Impact on Users Affected users unknowingly provided their home network bandwidth for proxy operations. Because the backdoor was baked into the device firmware, standard security software could not detect the initial compromise. The operators maintained full control over the devices, allowing them to push updates or remove applications without any user consent or notification. ## Broader Security Implications The disruption underscores the critical risks associated with supply chain security in low-cost consumer electronics. As manufacturers in regions like Shenzhen integrate complex firmware, the potential for pre-installed backdoors remains a persistent threat. Future mitigation requires stricter oversight of OEM firmware integrity to prevent mass-scale botnet recruitment and unauthorized network proxying. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._