Skip to content
Google Disrupts XCPE Botnet in 1.3 Million Android Devices

Google Disrupts XCPE Botnet in 1.3 Million Android Devices

First seen 2 Nov 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 19:47 UTC

On November 2, 2026, Google and industry partners announced the dismantling of the XCPE botnet, which infected over 1.3 million Android TV set-top boxes. The botnet was attributed to Videostrong Technology Co., which intentionally embedded a backdoor, known as x.cpe, into the firmware of these devices to facilitate cybercrime activities, including ad fraud and residential proxy services. The operation involved collaboration with Japan's National Police Agency and several security firms, resulting in the takedown of command-and-control servers and the disruption of access to at least 10 million additional compromised devices. Google has cut ties with Videostrong, banning them from producing certified Android devices or supplying software to certified vendors. The backdoor operates with system-level privileges, making it difficult for users to remove. This incident highlights significant supply chain risks and the need for improved security measures in device manufacturing.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-02
Google announces XCPE botnet disruption
Google and partners dismantled the XCPE botnet affecting over 1.3 million devices, cutting off access to 10 million more.
Cloud.Google
2026-11-02
Videostrong banned from Android certification
Google terminated its relationship with Videostrong and banned them from producing certified Android devices.
Bleepingcomputer
2026-11-02
Collaboration with law enforcement and security firms
The takedown involved Japan's National Police Agency and multiple security firms to analyze and disrupt the botnet's operations.
Thehackernews

More articles in this cluster (13)

Following this threat?

Track Backdoor and Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (55)

1 / 3

Common questions

What devices are affected by the XCPE botnet?
The XCPE botnet primarily affects Android TV set-top boxes, but also includes telehealth devices and karaoke machines.
What actions has Google taken against Videostrong?
Google has banned Videostrong from producing certified Android devices and cut ties with the company.
How does the XCPE backdoor operate?
The XCPE backdoor runs with system-level privileges, allowing it to install software silently and disable security features.