Google dismantles massive botnet hidden in Android TV boxes

Google along with several cybersecurity companies and Japanese law enforcement dismantled a global botnet called X.CPE that was hidden in more than 1.3 million set-top boxes across more than 200 countries.

Google said it tied the scheme to Videostrong Technology, a Chinese company that was an Android original equipment manufacturer producing a range of screens, speakers and robots. 

The overwhelming majority of the infected devices in the X.CPE botnet are Android TV set-top boxes, Google said, adding that they observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage devices. 

In lengthy reports about the scheme, Google and other cyber investigators accused Videostrong of monetizing the backdoor by “selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices.”

“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” Google said.  

“We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.”

Videostrong did not respond to requests for comment. The company says it has worked as an original equipment manufacturer for more than 14 years and sells a variety of AI-backed devices.

Image: Google

Millions of households

Google said Videostrong was allegedly turning infected devices into a residential proxy network and loading other types of malware onto X.CPE-compromised devices. 

The botnet generated revenue from the devices by reselling bandwidth, data exfiltration, delivering video content, ad fraud, loading additional backdoors and installing apps for payment. The software allowed third-party traffic to pass through a person’s internet connection, using their internet address and bandwidth. 

X.CPE was embedded in the device’s firmware before it even reached a person’s home and was built to evade security checks. Videostrong allegedly continued to change the malware used, updating it in 2024 and 2026. 

Google worked with Japanese police, as well as cybersecurity firms TrendAI, Human and Synthient, to disrupt the domains that underpinned the botnet.

“Our research identified over 1.3 million devices affected by this campaign,” said Robert McArdle, director of cybercrime research at TrendAI. “That's millions of households and businesses completely unaware that their equipment was being used as an accessory in active criminality — whether defrauding advertisers or piggybacking on their connections to carry out other attacks via residential proxies — which would commonly include identity theft impersonating people in their region.”

According to Google, Videostrong used “obfuscation techniques” to pass its security tests and load the malware onto the devices. Google pledged to change its review process to stop future manufacturers from conducting similar campaigns. 

Google said it took legal action to take down the domains Videostrong used to control the botnet and install the malware while also suing to destroy the domains used by other malware families loaded onto the devices. 

But they noted that even if a user tried to uninstall the malware, it would automatically reinstall, according to cybersecurity researchers. The backdoor was able to silently download other files onto the device and execute them without user consent. 

Google did not explain if customers with infected devices will be notified or if there is any effort to forcibly remove malware from compromised devices as U.S. law enforcement agencies have done in other similar botnet cases.  

In response to questions about removing the malware, Charley Snyder, head of disruption operations at Google Threat Intelligence Group, told Recorded Future News that their actions severed the domains the botnet was communicating with, “effectively rendering the malware benign." 

Google claimed the takedown of command and control domains of Videostrong's criminal affiliates may have also cut off cybercriminal access to an additional 10 million compromised devices — many of which are not Android devices.  

Videostrong and any future subsidiaries are now banned from selling Android devices or supplying software to certified vendors, Google said. 

“The x.cpe network was built for ongoing profit. By giving malware affiliates backdoor access, the operators conspired to monetize these devices long after purchase,” Google said. “Since at least late 2024, Videostrong has evolved its pre-installed malware from simple single-stage droppers into a modular, three-stage architecture designed for resilience and multi-tenant monetization.”

Tech companies like Google have increasingly turned to court orders to take down malicious tools or services used to target their customers. Microsoft used court orders multiple times this year to destroy phishing platforms, malicious AI tools, and cybercrime-as-a-service infrastructure.