Global Coalition Dismantles Massive Android TV Box Botnet
Security firms and Japanese police neutralize XCPE backdoor affecting 1.3 million devices.
1Botnet Disruption Operation
A coalition including Google, Lumen, and the Japanese National Police Agency successfully disrupted the XCPE backdoor. This operation targeted a massive botnet spanning over 200 countries, comprising 1.3 million infected Android TV boxes. The collaborative effort aimed to neutralize the infrastructure used for illicit proxy network traffic and remote device control.
2Manufacturer Involvement Identified
Google Threat Intelligence Group identified Shenzhen-based hardware manufacturer Videostrong Technology as the primary developer of the backdoor. The company allegedly embedded XCPE directly into device firmware before shipping. This deliberate action allowed criminal affiliates to gain unauthorized access to home networks, turning consumer hardware into tools for malicious traffic routing.
3Technical Backdoor Mechanism
The firmware utilized a management agent disguised as a standard remote-client tool. It communicated via an MQTT server to receive commands, enabling operators to install apps or modify settings remotely. By pulling updates from GitHub, the system maintained persistent control over devices, effectively masking malicious activity behind legitimate home internet connections.
4Scale of Network Activity
Between June 3 and October 1, TrendAI recorded over 3.8 million distinct IP addresses interacting with the botnet infrastructure. The coalition's decision to disrupt command-and-control domains is expected to sever access to an additional 10 million compromised devices. These affiliates utilized diverse distribution channels beyond the initial XCPE backdoor implementation.
5Google's Regulatory Response
Following the investigation, Google officially terminated its business relationship with Videostrong Technology. The manufacturer is now prohibited from producing devices that feature preloaded Google applications. This move serves as a significant enforcement action against OEMs that compromise user security by embedding malicious firmware at the point of hardware production.
6Connection to BadBox Ecosystem
This operation is linked to the broader BadBox 2.0 ecosystem, which previously compromised over 10 million devices. Human, Google, and TrendAI had previously disrupted this related network in March 2025. The persistence of these botnet operations highlights a recurring trend of supply chain vulnerabilities within the Android TV box hardware market.
7Impact on Consumer Privacy
Unsuspecting customers unknowingly facilitated proxy networks, as their internet connections were exploited for hidden traffic. Because the backdoor was pre-installed, users had no standard way to detect or remove the threat through typical software updates. This highlights the critical security risks associated with low-cost, unverified hardware manufacturers operating in global markets.
8Future Security Implications
The disruption signifies a shift toward multi-stakeholder interventions in hardware-level security threats. By targeting the command-and-control infrastructure, the coalition successfully mitigated risks for millions of devices. Moving forward, the industry must address firmware integrity to prevent manufacturers from acting as vectors for large-scale botnet deployment and unauthorized network access.