Google and Partners Take Down XCPE Botnet on 1.3m Set-Top Boxes

More than 1.3 million TV set-top boxes that left the factory with a hidden backdoor have been cut off from the people who controlled them. Google said on 2 November that it and industry partners dismantled the XCPE botnet last week, and that it assesses “with high confidence” that the backdoor was built and run for profit by the device maker itself, Videostrong Technology Co., an Android hardware manufacturer.

The case turns the usual advice about malware on its head. Owners did not click a bad link or install a dodgy app: in Google’s account, the code was built into the firmware and quietly turned living-room boxes into paid relays for ad fraud and residential proxy networks. The takedown also went after the criminal “affiliates” who rented that access, which Google says reaches far beyond the boxes themselves.

Seven partners took the XCPE botnet offline

According to a joint release issued by Plume, the operation was led by Google, Plume, TrendAI, Lumen, HUMAN Security and Synthient, working with Japan’s National Police Agency. Lumen’s Black Lotus Labs team, which TSN covered last week when it mapped Volt Typhoon’s covert network, brought network visibility to the effort.

Google lists four actions. It took legal action to take down the domains and servers Videostrong used to control the botnet, and the command-and-control (C2) domains of more than a dozen malware families loaded through the backdoor. It banned Videostrong, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors. And it says it is improving how it checks the integrity of firmware on certified Android TV devices, after Videostrong used obfuscation to load its code after a device’s first boot and so slip past Google’s tests.

“Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” said Charley Snyder, head of disruption operations at Google Threat Intelligence Group, in the partner release.

Google’s biggest claim is about reach. Because the affiliates also spread their modules through channels other than XCPE, Google assesses that taking down their C2 domains “will sever access to at least 10 million additional compromised devices”. That is Google’s estimate; the partners have not published a separate count.

How set-top boxes became residential proxies

Google says the backdoor, a system app called x.cpe, ran with system-level privileges and reinstalled itself on reboot if a user removed it. It switched off Google Play Protect’s app checks, then loaded modules from outside companies. Most turned the boxes into residential proxy exit nodes, which let paying customers route their traffic through a stranger’s home connection; others faked ad views in the background. Google also says Videostrong operators took live screenshots, injected keystrokes and pulled account and device data from some boxes.

TrendAI’s research post puts numbers on that from its own telemetry between June and October 2026: 1,472,554 infected devices across 206 models in more than 170 countries, and 3,849,226 distinct home and mobile IP addresses used as exits. It says the United Kingdom was one of five countries with roughly 26,000 to 42,000 infected devices each, and names Virgin Media among the consumer providers whose customers’ addresses ended up in the proxy pool. The partner release, using a different snapshot, says more than 200 countries.

TrendAI says owners cannot remove the implant themselves, because it is signed with the manufacturer’s key. Cutting the servers severs the operator’s control, but the code remains on every box already sold.

A device maker as the threat changes who must act

The uncomfortable lesson of the XCPE botnet is that the weakest point was the factory, not the user. Most consumer security advice assumes the hardware is honest and the danger arrives later, through a link, an app or a weak password. Here, Google says, the supplier designed the box to betray its owner and sold that access on, which puts the burden on platform owners, retailers and broadband providers rather than households.

That is why the platform ban matters as much as the server seizures. Taking domains down is a point-in-time blow, and Google itself warns that backdoor operators, ad-fraud rings and residential proxy providers form “an interconnected supply chain” that pivots quickly. Cutting a manufacturer out of certified Android removes a route to market, and forcing firmware checks closes the gap it used. It echoes the Virtualine seizure days earlier, where action against the service provider, not individual criminals, was the point.

For banks and online shops, the residential proxy angle is the sharper risk. Fraud checks often trust a login from a household broadband address in the customer’s own country; a proxy fleet like this sells exactly that disguise. Firms that lean on IP reputation for anti-fraud or KYC screening should treat this as evidence that a “clean” home IP proves little. Hijacked consumer devices and software are a recurring theme in TSN’s cyber coverage, from Cloudflare’s latest DDoS figures to Eye Security’s pre-emptive move against a Popcorn Time updater.

For readers, Google’s advice is practical: be “extremely wary” of apps that pay for “unused bandwidth”, stick to trusted app stores, keep Google Play Protect switched on, and buy set-top boxes only from reputable makers listed on Google’s Android TV partner site. TrendAI adds a plainer warning against unbranded or uncertified Android TV boxes. Videostrong has not commented publicly, and Google has not named the court behind its legal action; whether any of the affiliates rebuild on new servers is the next thing the partners say they will watch.

Sources

• Google Cloud Threat Intelligence: Shutting the Door on the XCPE Botnet
• TrendAI Research: TrendAI Research Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes
• Plume Design (PR Newswire): Industry Takedown of Botnet Hidden in More Than 1.3 Million TV Set-Top Boxes across 200 Countries

Related stories

• FBI Seizes Virtualine Domain as Dutch Police Take Servers Offline
• Eye Security Disabled a Popcorn Time Updater to Head Off a Botnet
• Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access
• Cloudflare Q3 DDoS Report: Giant Attacks Fall, Short Bursts Surge