Google has shut down one of the largest consumer device botnets ever found. In late October 2026, Google and its security partners dismantled the XCPE botnet, a network of more than 1.3 million compromised devices, most of them low cost Android TV set-top boxes. The malware was not installed by careless users. It was built into the devices at the factory, before anyone took them out of the box.
That detail is the real story. The same class of cheap, connected hardware sits in offices, clinics, waiting rooms and retail stores everywhere, often plugged into the same networks that carry business data. If a device can leave the factory with a hidden backdoor, then device buying and network hygiene are security decisions, not just purchasing decisions. This article explains what happened, how the backdoor worked, and what your business should do about the connected devices already on its network.
What Did Google Actually Take Down?
The takedown combined court action with technical disruption. In a post titled “Shutting the Door on the XCPE Botnet,” published on the Google Cloud blog on November 2, 2026, Google Threat Intelligence described legal action that seized the botnet’s command and control domains and servers. At the same time, Google and its partners moved against 12 or more affiliate malware families that rented access to the infected devices. The partner list shows how broad the operation was: the Japan National Police Agency, Lumen and its Black Lotus Labs team, HUMAN Security, Plume, Synthient and TrendAI all took part.
The scale was unusual even by botnet standards. Google put the total at more than 1.3 million devices. TrendAI, tracking the network between June 3 and October 1, 2026, counted 1,472,554 devices across 206 different models in more than 200 countries. The highest counts were in Malaysia, Brazil, Iraq, Mexico and Taiwan. This was not a problem confined to one region. The United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000 infected devices.
The takedown is also bigger than the headline number. Google expects the wider action against affiliate operations to sever criminal access to at least 10 million additional devices. In other words, the 1.3 million boxes were the visible core of a much larger access economy, one where control of ordinary household and workplace hardware is bought and sold.
How Did a Backdoor Get Into Certified Devices?
The backdoor, called x.cpe, shipped inside the firmware. It ran under the package name com.oemservice and was preinstalled by the device maker, Shenzhen based Videostrong Technology, a company that also sells boxes under the MECOOL brand. Google assessed with high confidence that the backdoor was deliberate, run for financial gain, with access to infected devices sold to affiliates who loaded their own money making modules.
The evidence Google published points directly at the maker. Investigators found a GitHub account named yf-videostrong hosting the relevant packages. They found a document signed by the firm’s research and development director stored in an open folder on a botnet server. The backdoor code itself even checks for a device property named ro.mecool.device, a reference to the maker’s own retail brand. Any one of these items might be explained away. Together, they describe a supply chain compromise that started at the source.
Certification did not catch it, and that should worry buyers. The malicious components stayed dormant while devices went through testing, then loaded their real code after the first boot in a customer’s home or office. Google describes XCPE as the first documented case of a Play Protect certified maker deliberately embedding a botnet in its products. The testing regime assumed the maker was honest. That assumption failed.
What Can the x.cpe Backdoor Actually Do?
x.cpe runs with system privilege, which means it owns the device. As a preinstalled system app, it can disable Google Play Protect checks, install further apps silently, execute commands sent by its operators, take screenshots, log keystrokes and steal account details and device information. Because it is part of the firmware, it also reinstalls itself from the device’s /oem partition after a reboot. Restarting an infected box does not clean it.
Most affiliates used that access for quiet, steady fraud. The modules found on infected devices mainly ran residential proxy services, including Honeygain, NetNut, Linkfog, GaGaNode and Traffmonetizer, which resell a device’s home or office internet connection to third parties. Other modules carried out ad fraud. For the device owner, the symptoms are easy to miss: a slightly slower connection, unexplained data use, and traffic leaving the network that nobody can account for.
The affected hardware goes well beyond TV boxes. That matters for businesses, because the same low cost Android hardware turns up in commercial settings where nobody thinks of it as a computer.
| Device type | Where businesses use it | Why it raises risk |
| Android TV set-top boxes | Reception areas, break rooms, hotel and rental properties | Always on, rarely updated, often on the main network |
| Digital signage players | Retail stores, restaurants, office lobbies | Connected around the clock and seldom inventoried |
| Telehealth devices | Clinics and remote care programs | Close to sensitive patient workflows and data |
| Karaoke and entertainment machines | Hospitality and leisure venues | Vendor supplied, almost never reviewed by IT |
Why Could Owners Not Simply Remove It?
The honest answer is that they cannot. The backdoor is signed with the maker’s own key and baked into the firmware, so it remains on the device even after the takedown. Google cut off the control servers, which stops the botnet from taking new orders, but the hidden door itself is still in the hardware. A factory reset may clear the extra modules affiliates installed, yet it does not remove x.cpe, because the reset restores the same compromised firmware.
Identification is harder than it sounds. Synthient has published a list of 182 affected device model names, which is a useful starting point for an audit. Google and its partners are clear about the caveat, though: a matching model name alone does not prove a specific device is infected, and a model missing from the list is not a guarantee of safety either. Businesses should treat the list as a screening tool, not a verdict.
Google has changed its own process in response. The company tightened firmware checks, revised how it reviews certified makers, and banned Videostrong, along with its future subsidiaries and affiliates, from the certified Android program. There is a precedent here too. In the BadBox 2.0 case, Google sued in July 2025 over a similar operation involving more than 10 million uncertified devices. XCPE is worse in one important respect: these devices carried certification, the very signal buyers rely on to judge trust. The full technical account is worth reading in Google’s own words in its post on shutting the door on the XCPE botnet, and the same team publishes ongoing research through Google Threat Intelligence.
Why Does This Matter for Your Business Network?
Because the modern office is full of devices IT never approved. This is the shadow IoT problem. A facilities manager buys a signage player. A branch office plugs in a cheap streaming box for the waiting room TV. A vendor installs a connected machine and connects it to whatever Wi-Fi is available. None of these devices go through procurement review, security checks or the asset register. Each one is a small computer with an operating system, a network connection and, as XCPE shows, sometimes a hidden agenda.
An infected device inside your network is a foothold, not a nuisance. A compromised box can be rented out as a residential proxy, which means strangers route their traffic through your connection and your public IP address takes the blame for what they do. It can scan the local network, harvest credentials typed into it, and serve as a quiet staging point for a larger intrusion. The risk is not the TV box itself. The risk is everything the box can reach. Our practical guide to how to protect your business from cyber threats covers the wider set of basics that apply here, from access control to patching discipline.
Vendor due diligence has to extend to hardware, not just software. Most companies vet their cloud providers and software vendors carefully, then buy network connected hardware on price alone. XCPE is a case study in why that gap is dangerous. A certified brand, a low price and a clean test result all turned out to be compatible with a factory installed backdoor. Procurement teams should ask who makes the device, who signs its firmware, how updates are delivered, and how long the maker commits to supporting it. If a vendor cannot answer those questions, the device does not belong on a business network.
How Can Your Business Protect Itself?
Start with an inventory, because you cannot secure what you cannot see. Walk the office, the warehouse and every branch. List every device connected to your wired and wireless networks, including the ones nobody remembers buying. Check model names against the list Synthient published. Treat no name brand, no name hardware from unknown makers as replace first and ask questions later, especially when it sits on the same network as your systems of record.
Then separate these devices from anything that matters. Put TVs, signage and guest facing hardware on their own network segment or guest Wi-Fi, with no route to file servers, finance systems or internal applications. Block outbound traffic you cannot explain. The checklist below works as a starting point for a quarterly review.
| Action | Why it helps | How often |
| Inventory every connected device | Removes blind spots that attackers rely on | Quarterly |
| Segment IoT and media devices | Limits what a compromised box can reach | Once, then verify quarterly |
| Buy only from makers with signed firmware and stated update policies | Reduces supply chain and abandonment risk | At every purchase |
| Remove or replace unsupported devices | Old firmware never gets fixed | Quarterly |
| Watch outbound traffic for proxy like patterns | Catches infections that audits miss | Continuously |
Monitoring is the layer that catches what the audit misses. Inventories go stale the week they are finished. Someone plugs in a new device, a vendor swaps a unit, and the blind spot is back. Continuous oversight of network traffic and device behavior is what turns a one time cleanup into an actual security posture, which is the thinking behind our overview of proactive IT monitoring. For organizations that are also modernizing older systems at the same time, this device hygiene work pairs naturally with a broader review of AI integration and modernization, since new platforms inherit whatever network they land on. As DenebrixAI often advises clients, the goal is not to ban connected devices. It is to know which ones you have, control what they can reach, and notice quickly when one starts behaving like someone else’s property.
Conclusion
The XCPE takedown is good news delivered with an uncomfortable lesson. Google, law enforcement and security partners dismantled a botnet of more than 1.3 million devices and cut criminal access to millions more. Yet the backdoor remains in the hardware, placed there by the manufacturer of certified products, invisible to the testing designed to catch it. For business leaders, the takeaway is practical. Your network is only as trustworthy as the least examined device plugged into it. Inventory your connected hardware, segment it, buy it with the same care you apply to software vendors, and monitor what it does. The next backdoor will not announce itself either.
Frequently Asked Questions
Can the XCPE backdoor be removed from an infected TV box?
No. The backdoor is part of the device firmware and signed with the maker’s key, so owners cannot remove it. A factory reset may clear modules that affiliates added later, but x.cpe itself returns because the reset restores the compromised firmware. Replacing the device is the safe option.
How can my business check whether its devices are affected?
Start by inventorying every connected device on your networks and comparing model names with the list of 182 affected models published by Synthient. Treat a match as a warning rather than proof, and watch for unexplained outbound traffic, which is often the clearest sign of a proxy module at work.
Does Android certification protect buyers from this kind of backdoor?
Not completely. XCPE is the first documented case of a Play Protect certified maker deliberately embedding a botnet, and the malware stayed dormant during testing. Certification still matters, but businesses should also check who signs the firmware, how updates are delivered and how long the maker supports the device.
Comments are closed