Google Disrupts XCPE Botnet and Bans Videostrong from the Certified Android Ecosystem
Google said it disrupted the XCPE botnet with partners, affecting more than 1.3 million devices. According to analysis, the preinstalled backdoors were found mainly in Android TV set-top boxes.
On November 3, Google Threat Intelligence Group said it had disrupted the XCPE botnet together with partners. The botnet was said to include more than 1.3 million devices, primarily Android TV set-top boxes. Google also banned manufacturer Videostrong and its future subsidiaries or affiliates from manufacturing and selling certified Android devices or supplying software to other certified manufacturers.
According to Google, this was not a typical infection caused by a downloaded app. The component identified as x.cpe, sometimes com.oemservice, was preinstalled directly in the firmware of devices with system privileges. It was capable of downloading additional modules, allowing attackers to expand the functionality of compromised devices.
XCPE botnet and disruption of its command infrastructure
Google took legal action against the domains and servers controlling XCPE. The measure also covered C2 domains used by more than a dozen malware families distributed through these backdoors. C2, or command-and-control infrastructure, is used for communication between operators and compromised devices.
Disrupting such infrastructure may limit the botnet’s current control. By itself, however, it does not confirm that all affected devices have been cleaned. Google has not yet published a universal fix for owners of these devices.
Because the malicious component was located in the firmware, removing it through a normal app uninstall may not be possible, according to available analyses. Google also did not publish a complete list of the specific models or individual units that remain infected. The model name alone is therefore not evidence that a particular device is compromised.
Backdoors also found in a purchased MECOOL device
Independent research firm Synthient said it found preinstalled backdoors in a sample of the MECOOL KM9PRO Max device it purchased late in 2025. The firm estimated at least 1.3 million compromised devices. Its findings match the scale cited by Google in its announcement.
Google and Synthient link the operation to Videostrong with a high degree of confidence. However, the claim that the company deliberately created and operated the botnet represents an assessment by these researchers and Google; it is not a judicial finding or a publicly announced statement from Videostrong.
According to Google, the infrastructure may have been used for advertising fraud, residential proxy services and the deployment of additional malware. With residential proxies, internet traffic is routed through the connections of compromised users’ devices, which may give it a more credible origin than traffic from a data center.
Google changes checks for certified Android TV devices
The case concerns the consumer electronics supply chain: malicious code may have been part of the firmware when the device was offered for sale. Google said it changed its checks for certified Android TV devices following the findings. According to the company, the manufacturer evaded testing by activating the malicious code only after the first launch.
In this case, Android device certification therefore did not mean that a malicious component could not enter the firmware after the relevant tests had been completed. Google banned Videostrong from further participation in the certified Android ecosystem, but the announcement does not specify what measures will be available to owners of devices already sold.
What happens next
Further developments will depend mainly on the publication of technical and legal details about the disruption. Google or the relevant authorities may provide additional information about the domains and servers targeted by the legal action. It will also be important whether Videostrong issues a statement or challenges the findings by Google and Synthient.
It remains open whether manufacturers and sellers will publish lists of affected models, withdraw devices from sale, offer replacements or prepare security updates. Researchers will also monitor whether replacement C2 domains or new malware variants appear after the disruption.
Sources
- Google Cloud Blog — Shutting the Door on the XCPE Botnet – Confirms Google’s announcement about the XCPE disruption, the botnet’s scale, legal action, the ban on Videostrong and the backdoors’ technical operation.
- Synthient — The Internals of a Badbox Operation – Provides its own technical analysis of the MECOOL device, attribution indicators linking it to Videostrong, a scale estimate and risk-mitigation recommendations.
- BleepingComputer — Google disrupts million-device XCPE Android malware botnet, bans TV box maker – Independently summarizes Google’s announced actions, the malware’s technical capabilities and its connection to Synthient’s research.
Verified and updated: 03. 11. 2026 06:22
