Global Coalition Busts 1.3M-Device Android TV Botnet Baked In at the Factory

A coalition of cybersecurity firms and Japan's National Police Agency have disrupted the XCPE backdoor, which powered a botnet spanning over 1.3 million Android TV boxes and other devices across more than 200 countries, according to a report by Register. The operation involved Google, Lumen, Human Security, Plume, Synthient, and TrendAI.

According to the Google Threat Intelligence Group, the backdoor and botnet were likely developed and operated by Videostrong Technology, a hardware manufacturer based in Shenzhen, China. Google states the company intentionally embedded the XCPE backdoor into device firmware and sold access to criminal partners, allowing them to push unauthorized malware modules onto hardware shipped to unsuspecting buyers.

When users plugged the devices into their home networks, the pre-installed backdoor let operators create proxy networks and siphon internet traffic without the owners' knowledge. TrendAI noted that the management agent disguised itself as a standard remote administration client, pulling updates from GitHub and connecting to an MQTT server for full remote control. Between June 3 and October 1, 2026, TrendAI tracked over 3.8 million unique IP addresses tied to the operation.

The coalition also targeted C2 domains used by affiliated actors. Because these partners maintained independent distribution channels alongside XCPE, the Google Threat Intelligence Group estimates that disabling their infrastructure cuts off access to at least 10 million additional compromised devices. Google severed its relationship with Videostrong Technology and barred the manufacturer from releasing devices with its pre-installed apps.

Source: habr