Google, Partners Disrupt 1.3 Million-Device-Strong XCPE Botnet

Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity.

Google and industry partners disrupted the XCPE botnet, a cybercriminal operation that planted a backdoor in more than 1.3 million Android-based set-top boxes, turning consumer devices into infrastructure for malicious activity.

The operation, attributed with "high confidence" by Google's Threat Intelligence Group (GTIG) to Android device manufacturer Videostrong Technology Co., involved deliberately embedding the XCPE backdoor malware in multiple device models and brands since at least 2024, according to a blog post published earlier this week by GTIG.

Rather than simply exploiting vulnerable devices, however, the manufacturer allegedly built a system that allowed criminal affiliates to access compromised hardware and deploy their own malicious software, Google said.

"Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices," according to the post. "These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices."

Taking Action Against XCPE, Videostrong

Google and its partners, which included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, took legal action against Videostrong to disrupt the domains and servers it used to control the botnet, install affiliate malware modules, and operate the command-and-control (C2) infrastructure used by those modules.

Because the affiliate modules "each have diversified distribution channels for their modules beyond XCPE," Google assessed that disrupting their C2 infrastructure "will sever access to at least 10 million additional compromised devices," according to the post.

Google has also cut ties with Videostrong and banned the manufacturer, along with any future subsidiaries or affiliates, from building or selling certified Android devices or supplying software to other certified vendors. Videostrong did not immediately return Dark Reading's request for comment on Wednesday.

Vulnerable Devices Ensnared in XCPE

Most devices infected by the XCPE botnet were Android TV set-top boxes. However, the botnet also included other Android-based IoT devices, including telehealth equipment, karaoke machines, and digital signage systems, according to Google.

This wider exposure of IoT devices is reflected in Bitdefender's "2026 IoT Security Landscape Report," released this week. The findings recorded 5.4 billion security events and 6.2 billion vulnerability observations across devices behind approximately 10.4 million monitored routers between January and September 2026. While these figures represent detected activity and identified device vulnerabilities rather than confirmed compromises, they underline the scale of the threat facing connected devices and the potential attack surface they present to businesses.

While most of Videostrong's interactions with victim devices involved installing, uninstalling, and configuring malware modules, operators also carried out so-called "sensitive actions," according to Google. These include capturing live screenshots; injecting keystrokes; exfiltrating sensitive information, such as account and device details, package inventories, and system logs; and executing shell scripts and commands, including those used to establish reverse shells on infected devices.

Botnet Repercussions for Businesses

Although the operation primarily targeted consumer devices, it has significant security implications for businesses and enterprise organizations. XCPE demonstrates how compromised IoT equipment can be turned into criminal infrastructure, providing attackers with residential proxy networks that help conceal malicious activity, evade IP-based security controls, and facilitate fraud.

"By turning 1.3 million devices into residential proxies, threat actors fuel the exact infrastructure used to attack high-value API endpoints," says Mark Mazur, field chief technology officer (CTO) for mobile application security firm Approov.

Because attacks launched through the botnet can originate from legitimate consumer IP addresses, standard security defenses such as geo-blocking, ASN blocking, and IP reputation filters "are practically useless against them," he says.

"They are creating infrastructure, largely based on IoT devices, that can power sophisticated credential stuffing and API abuse campaigns," Mazur adds.

The malware's ability to execute remote commands, conduct network reconnaissance, and maintain persistent access also raises concerns about connected devices deployed in corporate and healthcare environments. Digital signage, televisions, and telehealth equipment, for example, could provide attackers with an opportunity to explore networks or establish a foothold if compromised devices are connected to inadequately segmented networks. Google has not confirmed that any such activity has occurred, however.

OEMs as Bad Actors

Google requires original equipment manufacturers (OEMs) to undergo a comprehensive suite of compatibility and security tests to participate in the Android ecosystem. However, Videostrong was able to evade these checks by "employing obfuscation techniques" that exploited a weakness in the review process, according to Google. The malicious code was loaded after the device's first boot, allowing it to bypass the initial security checks.

Calling Videostrong's actions "an unacceptable breach of trust," Google said it has since strengthened its review processes to protect the integrity of Android TV firmware and "better safeguard against similar activity in the future," according to the post.

As an additional protective measure, Google encouraged consumers to be wary of applications offering payment in exchange for "unused bandwidth" or "sharing your Internet," as these could turn their set-top boxes and other IoT products into part of a residential proxy network.

"These applications are primary ways for illicit proxy networks to grow, and could open security vulnerabilities on the device's home network," according to the post.

Google also urged Android users to stick to trusted app stores, review the permissions requested by third-party VPN and proxy applications, and ensure built-in security protections such as Google Play Protect are active.

Finally, Google called on mobile platforms, ISPs, online marketplaces, and other technology providers to continue sharing threat intelligence and implementing security best practices to identify malicious backdoors, illicit proxy networks, and other harmful software to prevent similar botnet operations from emerging in the future.