Google has dismantled a botnet of over 1.3 million Android devices—primarily TV set-top boxes—after determining a Shenzhen-based manufacturer, Videostrong, embedded a persistent backdoor and sold access to criminals. The takedown, activated in late October 2026, targeted servers and malware families that had been using the backdoor for fraud and illicit network routing.
How the botnet worked and what it did
The backdoor, dubbed x.cpe, was baked into various firmware builds over multiple years across many device models. It ran as a system app with full system privileges and connected to command-and-control (C2) servers. Once in place, it could disable Google Play Protect, hide from detection, install software stealthily, capture screenshots, keystrokes, device metrics, and even launch reverse shells. Some modules converted devices into residential proxies or carried out ad view fraud.
While most compromised units are Android TV boxes, infection spread to devices such as digital signage systems, karaoke machines, and some telehealth equipment. A scan by TrendAI revealed at least 1.47 million compromised devices across 206 models between early June and October, with Malaysia, Brazil, Iraq, Mexico, and Taiwan among the hardest hit. The United States, Germany, the UK, Australia, and Canada had tens of thousands of affected units each.
Videostrong’s role and response
Google’s investigation concluded that Videostrong intentionally built x.cpe into firmware, rather than this being the result of an insider leak or mistake. The company was banned from producing certified Android devices or supplying software to others. Evidence tying Videostrong to operations includes shared IP addresses, firmware ownership, and control structures embedded in device apps.
Despite efforts like factory resets, the backdoor remains intact in most cases—it reinstalls itself after reboot and is signed with the OEM’s key. Security firms recommend disposing of affected devices altogether. Anyone who still has such hardware is advised to disconnect it, block known C2 domains and IPs, and isolate IoT or smart devices from critical systems.
What this reveals and what’s changing
The incident exposed gaps in Android’s certification and security vetting for device makers: Videostrong hid malicious code post-boot to evade review. In response, Google has revised its firmware certification process for Android TV hardware to strengthen inspections.
Security groups involved—Lumen, HUMAN Security, Plume, Synthient, TrendAI, and Japan’s National Police Agency—collaborated with Google in the takedown effort. Together, they built a list of over 180 suspicious model names, cautioning consumers that model branding alone doesn’t guarantee infection.
For organizations, these developments underscore how unmanaged consumer devices—especially those running uncertified or lightly controlled firmware—pose serious risks. Compromised IoT gear on home or hybrid networks can serve as low-cost beachheads for broader attacks. It’s increasingly clear that supply chain integrity and firmware-level transparency must be as rigorously audited as software used in enterprise stacks.
