Google partners took down a backdoor affecting over 1.3 million set-top boxes
Google and industry partners dismantled XCPE, a backdoor that enrolled more than 1.3 million set-top boxes in a botnet, according to Google's Threat Intelligence Group. Google identified Shenzhen-based Videostrong Technology Co. as the manufacturer behind the operation and barred it from certified Android hardware and software. Google has not clarified whether a factory reset removes the backdoor.
More context
Google’s Threat Intelligence Group says partners took down XCPE, the backdoor that had enrolled over 1.3 million set-top boxes in a botnet. Google identified Shenzhen-based Videostrong Technology Co., an Android device maker, as the company behind it, saying the backdoor was built into device firmware and access was sold to criminal groups. The groups mainly used the boxes as residential proxies, routing traffic through users’ home internet connections, and for ad fraud. Google cut ties with Videostrong, barred it from making devices with pre-installed Google apps and stopped it from supplying software to other certified device makers. Google says the disruption is expected to cut access to at least 10 million additional devices. It has not detailed how owners can remove the backdoor; reports say it is unclear whether a factory reset would do so.
Was this story useful?
What was the main problem? (optional)
Reporting
- Shattered — Google Cuts Videostrong Over XCPE Botnet: 5 Facts [2026]
- krebsonsecurity.com — Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies – Krebs on Security
- pasqualepillitteri.it — Google bans Videostrong over backdoor in 1.3 million Android TV boxes
- meteoraweb.com — Google Takes Down XCPE Botnet on Android TV Boxes • Meteora Web
- thehackernews.com — Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
- techbuzz.ai — Google Bans Partner After 1.3M Android Boxes Turned Botnet | The Tech Buzz
- lavx.hu — Google disrupts 1.3 million-device Android botnet, says TV box maker sold criminal access | LavX News
- securityaffairs.com — Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers
Verifier’s note
Krebs on Security and the other listed publishers report that Google and industry partners dismantled the XCPE botnet, which had enrolled more than 1.3 million TV boxes used as proxies. The reports are dated November 2–3, 2026, consistent with the proposed event’s timing.