--- title: "Google bans TV-box maker Videostrong, which it says backdoored 1.3 million boxes" summary: "What Google’s 3 November account of the XCPE takedown says: the backdoor, who Google says built it, what the boxes were made to do, and what certification tells a buyer." url: https://www.thetechbag.com/blog/xcpe-botnet-1-3-million-tv-boxes-maker-banned format: Note desk: "Security" area: "Endpoints & devices" region: Global published: 2026-11-03 facts_checked: 2026-11-03 author: TechBag (The TechBag Journal) tags: ["XCPE","Videostrong","Google Threat Intelligence Group","botnet","Android TV","set-top boxes","residential proxy","ad fraud","Play Protect","BadBox","NetNut","IoT","digital signage","CERT-In"] cover: https://www.thetechbag.com/blog/covers/xcpe-botnet-1-3-million-tv-boxes-maker-banned.png --- # Google bans TV-box maker Videostrong, which it says backdoored 1.3 million boxes *What Google’s 3 November account of the XCPE takedown says: the backdoor, who Google says built it, what the boxes were made to do, and what certification tells a buyer.* Note · Security · Endpoints & devices · By TechBag · Published 2026-11-03 · Facts checked 2026-11-03 · Canonical: https://www.thetechbag.com/blog/xcpe-botnet-1-3-million-tv-boxes-maker-banned Google says the backdoor in more than 1.3 million Android TV set-top boxes was built and run by an Android device maker. On 3 November its Threat Intelligence Group wrote that, the week before, Google and partners had dismantled the XCPE backdoor, and that it assesses “with high confidence” that the backdoor and botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”, an Android manufacturer and design house. Google has cut ties with Videostrong and banned it, and “any future subsidiaries or affiliates”, from building certified Android devices or supplying software to certified vendors.[1] Google also took legal action to take down the domains and servers that controlled the botnet, and the command servers of more than a dozen malware families loaded through it. Because those affiliates spread their code by other routes too, Google assesses that the takedown “will sever access to at least 10 million additional compromised devices”. It names its partners as Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.[1] ## What Google says the boxes were built to do By Google’s account the backdoor, `x.cpe`, sits in the firmware at system privilege and reinstalls itself on reboot if removed. From late 2024 it passed commands to a separate loader that installs modules written by other firms, which buy the access. Videostrong “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot”, Google writes; it has changed its review process since.[1] **Figure: The backdoor ships in the firmware, then rents the boxes to other firms as proxy and ad-fraud capacity** *How XCPE worked, as Google Threat Intelligence Group describes it, from late 2024 to its takedown in late October 2026* 1. 01Built in at the factoryx.cpe is preloaded in the firmware with system privilege; uninstalled, it returns on reboot. 2. 02Phones homeAn HTTP check-in, then a standing MQTT link for commands. It switches off Play Protect’s app checks. 3. 03Loads affiliates’ codeA loader, and since August 2026 single-purpose droppers, install modules other firms wrote. 4. 04Sold as trafficResidential proxy exit nodes (Linkfog, AppSalt, NetNut), ad fraud (HiddenView, CBOXTV), and more backdoors. Source: Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet · as of 3 November 2026 · Module names are Google's examples, not a full list. Operators also captured live screenshots, injected keystrokes, took account and device data and opened reverse shells, Google says. Most infected devices are set-top boxes, but it also found telehealth devices, karaoke machines and digital signage.[1] ## Why a living-room box is an office problem Residential proxy networks sell the ability to route traffic through IP addresses that internet providers own, Google explains. In one week of June 2026, Google counted 316 distinct threat clusters, including cybercriminal and espionage groups, using suspected exit nodes of NetNut, one of the proxy networks XCPE loaded. Such nodes let attackers mask where they come from and run password-spray attacks, and reach other devices on the same network, Google said.[3] In July 2025 Google sued the operators of BadBox 2.0, which had compromised over 10 million uncertified devices.[4] ReportedWhat certification checks, and what it missed here Google’s help page says Play Protect certified devices “have passed Android compatibility testing”, and gives the check: Play Store, profile icon, Settings, About.[2] In XCPE’s case, Google says, the code loaded after first boot, past its tests. On 3 November Videostrong’s own website still listed a “Google Certified Android TV Box”.[5] Google’s advice is to buy from reputable manufacturers on its partner list.[1][6] Our viewOur view: for a meeting room or a signage screen Count each TV box, stick and signage player as an endpoint: in the asset list, on its own network segment, with outbound traffic watched. Google’s post lists the domains, IP addresses and file hashes to search DNS and firewall logs for, including MQTT on ports 3885 to 3887.[1] In India Google’s post does not name India and gives no counts by country. CERT-In’s Directions of 28 April 2022 list “Attacks on Internet of Things (IoT) devices and associated systems” and malicious code such as bots among incidents to report within 6 hours of noticing.[7] Device-management tools that enrol Android signage and kiosks are compared in our [UEM and MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm). How we did this Figures as of 3 November 2026, 7pm IST Every fact about XCPE is from Google’s post of 3 November, and the attribution to Videostrong is Google’s assessment; we found no statement from Videostrong. The 1.3 million and 10 million are Google’s figures; it does not say how it counted them. The NetNut and BadBox figures are from Google’s own earlier posts. Synthient’s write-up could not be opened, and we found no posts from the other partners on the day. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet (including indicators of compromise)](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet) — 3 November 2026 2. [Google Play Help, Check & fix Play Protect certification status](https://support.google.com/googleplay/answer/7165974) — undated help page 3. [Google Threat Intelligence Group, Google's Continued Disruption of Malicious Residential Proxy Networks (NetNut)](https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks) — 3 July 2026 4. [Google, We're taking legal action against the BadBox 2.0 botnet](https://blog.google/innovation-and-ai/technology/safety-security/google-taking-legal-action-against-the-badbox-20-botnet/) — 17 July 2025 5. [Videostrong Technology, company website (product list)](https://www.videostrong.com/) — undated page 6. [Android, Play Protect certified partners](https://www.android.com/certified/partners/) — undated page 7. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 Related on TechBag: the [Esper page](https://www.thetechbag.com/esper), for Android devices dedicated to one job, and the [secure web and DNS guide](https://www.thetechbag.com/browse/network-security-sase/secure-web-dns). **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [UEM and MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — the tools that enrol and lock down Android devices, kiosks and signage - [Esper intel hub](https://www.thetechbag.com/esper) — device management for dedicated Android devices such as signage and POS - [Secure web and DNS guide](https://www.thetechbag.com/browse/network-security-sase/secure-web-dns) — DNS filtering that can block known command-and-control domains