Summary
- Google links the XCPE backdoor to device manufacturer Videostrong.
- More than 1.3 million set-top boxes were enrolled through the backdoor.
- The wider affiliate infrastructure disruption affects a separate device population.
Google has disrupted a botnet involving more than 1.3 million Android set-top boxes and accused a device manufacturer of deliberately introducing the backdoor that allowed criminal operators to monetise access to the equipment.
The Google Threat Intelligence Group identified the operation as XCPE and assessed with high confidence that Chinese manufacturer Videostrong Technology was responsible for inserting the malicious functionality into affected products.
The backdoor was associated with Android television devices supplied through an original equipment manufacturing chain. Google says it could activate after initial device setup, enabling access that the eventual owner had not knowingly authorised.
Rather than infecting users solely through malicious downloads, this operation exploited trust in software present before the hardware reached the customer. The device could appear to function normally while running components able to receive instructions from criminal infrastructure.
Google says operators and affiliates used the access for activities including advertising fraud, residential proxy services, and delivery of additional malicious software. Those operations could exploit a household or business internet connection without the owner’s knowledge.
Residential proxy services are attractive to criminals because traffic routed through legitimate customer networks can appear to originate from ordinary users rather than servers already associated with malicious activity.
The operation also involved a wider ecosystem of affiliated malware and command infrastructure. Google estimates that separate action against associated domains could interrupt access to at least 10 million additional devices affected by criminal modules.
That larger number does not represent an additional 10 million set-top boxes proved to contain the XCPE manufacturer backdoor. It refers to the broader collection of devices potentially affected by disruption of affiliate infrastructure.
The two measurements describe different populations and should not be combined into a single count of manufacturer-compromised equipment. Google also has not established that every affected device has been permanently remediated.
The investigation raises a particular problem for organisations purchasing connected equipment. Firmware, preinstalled applications, and supporting services may pass through several suppliers before a product is installed, while the buyer sees only the brand under which it is sold.
Security responsibilities can be divided between the original manufacturer, firmware developer, hardware distributor, platform provider, and eventual operator. That chain complicates efforts to determine who introduced a harmful component and who is responsible for removing it.
A compromised device may create operational risks beyond the intended consumer application. If the equipment can connect to other services or shares a network with business systems, an attacker-controlled process may generate traffic or access opportunities outside its stated purpose.
The effect depends on network configuration and device privileges. Compromise of a set-top box is not proof that an entire household or enterprise network has been breached, but it can provide an unwanted network presence that requires investigation.
Google said it took action against Videostrong’s involvement in its certified device ecosystem and strengthened elements of its manufacturer review process. Those responses address both the specific infrastructure and trust in the device supply process.
Within Europe, the Cyber Resilience Act introduces cybersecurity requirements for manufacturers of products with digital elements. Reporting obligations for specified vulnerabilities and incidents began in September 2026, with the principal product requirements taking effect in December 2027.
Those rules address product lifecycle security and vulnerability handling, although the precise responsibilities of individual companies will depend on their roles in placing products on the European market.
The XCPE case shows how malicious software installed upstream can bypass assumptions that devices are clean when first connected. Routine consumer behaviour may not be enough to identify code that arrived as part of the product.
Google’s infrastructure disruption has removed important channels used by the operation. The remaining task of identifying and replacing or cleaning affected hardware is distinct from disabling the systems through which criminal affiliates controlled it.
