On this page · 5 sections ▾
Google and a group of security firms working with Japan's National Police Agency disrupted XCPE, a backdoor that Google says Videostrong Technology built into Android device firmware, creating a botnet of more than 1.3 million devices. Google Threat Intelligence Group announced the action on November 2, and Google has cut ties with the Shenzhen-based manufacturer.
Key facts
- XCPE reached more than 1.3 million Android devices in more than 200 countries, according to The Register.
- Google, Lumen, Human Security, Plume, Synthient and TrendAI took part in the disruption alongside Japan's National Police Agency.
- Google says taking down affiliate command-and-control domains will sever access to at least 10 million additional compromised devices.
- Videostrong and its subsidiaries are banned from making devices with preloaded Google apps, selling certified Android devices, or supplying software to other certified vendors.
- Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses tied to the operation.
How the backdoor worked
Google says it assesses with high confidence that the backdoor was developed, deployed and run for financial gain by Videostrong. The company sold access to criminal affiliates, who loaded their own malware modules onto devices shipped to buyers, according to The Register.
The Register reports that, per TrendAI, the firmware included a management agent posing as a standard remote-management client. It pulled updates from a GitHub page and connected to an MQTT server that gave operators full remote control, including installing and removing apps and changing settings.
The Verge reports the secondary modules performed ad fraud, enrolled devices in residential proxy networks and loaded further malware. The malware appeared across many models and brands over several years. Most were Android TV set-top boxes, but telehealth devices, karaoke machines and digital signage were also affected.
A gap in certification
As 9to5Google notes, these were sold as certified Android devices, which implied they were safe. Google says the makers used obfuscation to exploit a gap in its tests and loaded malicious code after the first boot. Google says it has updated its review process for manufacturers.
The same outlet reports that Synthient compiled a list of potentially affected devices, focused on the Mecool brand. It adds that Mecool has been rumored to be shutting down. That is a rumor, not a confirmed fact in the sources.
The Register links the operation to BadBox 2.0, a botnet of more than 10 million devices that Human, Google and TrendAI disrupted in March 2025.
What owners should do
Taking down servers does not necessarily remove malware already on a device, according to Digital Trends. It also reports that the backdoor could reinstall malware after a restart. Its advice: buy from reputable manufacturers, keep Google Play Protect enabled, and disconnect any Videostrong device from the internet and consider replacing it. 9to5Google says affected boxes should be safe to use after the shutdown but that owners may want alternatives.
