When a botnet gets dismantled, it’s usually because researchers traced an infection back to a phishing email, a cracked plugin, or an unpatched server. The XCPE botnet that Google and a group of industry partners just took apart was different: according to Google’s November 2 report, the backdoor wasn’t something attackers smuggled onto devices after the fact. It was built into the firmware by the manufacturer itself, before the hardware ever left the factory.

Google says it has linked the operation with high confidence to Videostrong Technology, an Android set-top box maker it accuses of deliberately engineering and operating the backdoor for profit. More than 1.3 million devices — predominantly Android TV boxes, but also telehealth equipment, karaoke machines, and digital signage — were enrolled in the network. As punishment, Google has permanently barred Videostrong, along with any future subsidiaries or affiliates, from producing certified Android devices or supplying software to certified manufacturers.

A Backdoor Designed to Survive Being Removed

What made XCPE particularly stubborn is where it lived. The backdoor component, identified under the names x.cpe and com.oemservice, ran with full Android system privileges and was stored on the device’s /oem/ partition. Uninstalling the malicious package didn’t actually fix anything — the firmware would simply reinstall it after the next reboot. Google’s researchers also found hidden code that loaded immediately after first boot, apparently designed to slip past the device’s own security checks before they could flag anything unusual.

The architecture behind the botnet was split into three layers, which helped separate remote command-and-control from the actual malicious activity on each device:

• The core backdoor received instructions from attacker infrastructure.
• Those instructions were passed to a loader component, com.abc.nexus, which configured additional “affiliate” modules.
• The affiliate modules carried out the actual abuse — turning devices into proxy exit nodes, generating fraudulent ad views, or dropping yet more malware.

That separation of duties made the botnet harder to spot through casual inspection, since the visible backdoor component didn’t itself perform the obviously malicious behavior — it just handed off the work. Command traffic ran over MQTT, a lightweight messaging protocol more commonly associated with legitimate IoT applications, with Google identifying the domain mqtt.szbboys[.]com operating across ports 3885 through 3887. Through this channel, operators could silently install apps, run shell commands, capture device screens, inspect connected networks, inject keystrokes, and even open remote shell sessions — all while disabling Google Play Protect’s verification checks to avoid detection.

A Takedown That Reaches Well Beyond XCPE

Dismantling XCPE wasn’t a solo effort. Google coordinated with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to take legal and technical action against the botnet’s servers and control domains — infrastructure that, according to Google, also served more than a dozen other affiliate malware families riding on the same network. Google estimates the broader disruption will cut off access to at least 10 million additional compromised devices beyond XCPE’s own 1.3 million, though that figure describes severed infrastructure rather than devices Google has individually cleaned.

This isn’t Google’s first fight against preinstalled or deeply embedded Android malware on cheap connected hardware. The company has previously taken legal action against the BadBox 2.0 operation, which affected more than 10 million uncertified devices, and researchers have separately tracked the original BADBOX campaign to roughly 190,000 infected Android boxes. Google is careful to note those earlier totals shouldn’t be added to XCPE’s — each is a distinct operation — but together they paint a consistent picture of budget streaming boxes and other low-cost Android hardware as a persistent, large-scale weak point in the consumer device ecosystem.

What Google Is Telling Buyers to Do

In response, Google says it has changed parts of its device certification review process and is tightening firmware integrity checks going forward. For consumers, the company’s advice is the same guidance that applies to any budget connected-device purchase:

• Buy from manufacturers with an established reputation, and check Google’s certified partner list before purchasing a streaming box.
• Stick to official app stores rather than sideloading apps from unknown sources.
• Keep Google Play Protect enabled rather than disabling it for convenience.
• Treat any app or service that offers payment in exchange for sharing your device’s unused bandwidth as a red flag.

Google is explicit that taking down the botnet’s infrastructure disrupts the operation — it does not guarantee that every one of the 1.3 million affected devices is now clean. Anyone running an unbranded or unusually cheap Android TV box would be reasonable to treat unexplained network activity, or a device that behaves sluggishly for no obvious reason, as worth investigating further.