Google Disrupts XCPE Android Botnet, Bans Videostrong Technology

Google, in collaboration with various industry partners, has successfully dismantled the XCPE malware botnet, which comprised over 1.3 million Android TV streaming boxes. This extensive operation culminated on November 2, 2026, and was revealed in a report detailing how the manufacturer, Videostrong Technology Co., intentionally infected devices with malware for profit through a range of cybercrime activities.

The XCPE Botnet Unveiled

The XCPE botnet is particularly noteworthy because it bypassed traditional entry methods used by malware, embedding itself directly into the firmware of devices manufactured by Videostrong. Google’s Threat Intelligence Group (GTIG) investigated the infrastructure and concluded that the botnet was developed and operated for financial gain. It revealed that the malware was embedded in device firmware during the manufacturing process, giving it an enduring presence and enabling it to evolve over the years.

Malware Distribution Methodologies

Unlike typical botnets that rely on vulnerabilities or user deception to spread, the XCPE botnet utilized a more insidious method of inclusion. Videostrong reportedly had been developing and disseminating this malware ferociously across multiple brands and models since at least 2024. This involved changing configurations constantly to evade detection.

Commands Executed by Infected Devices

The XCPE botnet provided itself as a multi-faceted cybercrime platform. Once a device was compromised, it could be commanded to perform a series of malicious actions, including but not limited to:

• Silently downloading additional Android applications.
• Disabling Google Play Protect.
• Executing shell commands with system-level privileges.
• Capturing screenshots and injecting keystrokes.
• Collecting device details, installed application lists, and system logs.

Malware Modules

The botnet was versatile enough to be adapted for various cybercriminal enterprises. It used different malware modules associated with ad fraud and residential proxy services, which allowed for the hijacking of internet traffic without user knowledge. Some of the notable modules identified by Google include:

Discovery and Evidence Against Videostrong

Cybersecurity firm Synthient played a pivotal role in tracing the XCPE backdoor to Videostrong. Following an investigation of a commonly purchased model, the MECOOL KM9PRO Max Android TV box, Synthient uncovered a publicly accessible directory related to the malware on a specific server. This file included a document authored by Owen Cao, the R&D director, indicating a direct link to the company. Furthermore, evidence revealed that Videostrong had registered multiple email addresses to sign the backdoors used in the botnet.

Google’s Response and Dismantling the Botnet

As a part of the takedown operation, Google worked closely with Japan's National Police Agency and several security companies, including Lumen, HUMAN Security, Plume, Synthient, and TrendAI. This collaborative effort resulted in the shutdown of critical command-and-control (C2) servers that were facilitating the botnet, disrupting operations not just for XCPE but also impacting at least 10 million additional compromised devices tied to various malware families.

Consequences for Videostrong Technology Co.

In response to the findings, Google has taken significant action against Videostrong, including:

• Termination of its partnership with the company.
• Revocation of its license to manufacture Android TV devices preloaded with Google apps.
• Banning the company from producing certified Android devices.

This decisive step underscores how critical it is for tech companies to remain vigilant against threats that originate from their manufacturing partners.

Future Implications and Recommendations for Users

Despite the disruption of the XCPE botnet, Google warns that users must take action to safeguard their devices. If infected devices are removed from the botnet, they could still reinstall the malware due to its persistent nature. This occurs because the malware resides in the "/oem/" partition. Users are urged to either:

• Install clean firmware to eliminate the infection.
• Disconnect the affected device from the internet to limit further malicious activity.

Key Takeaways

• 1.3 million Android TV boxes were part of the XCPE malware botnet.
• Videostrong Technology Co. is accused of intentionally embedding malware in device firmware.
• Malware modules include functions for ad fraud and turning devices into residential proxies.
• Google has banned Videostrong from producing certified Android devices.
• Users are strongly advised to clean infected devices with fresh firmware.

Conclusion

The takedown of the XCPE botnet serves as a critical reminder of the vulnerabilities existing within the device manufacturing process, especially when devices are mass-produced by manufacturers that do not prioritize security. Google's decisive actions against Videostrong Technology Co. reflect an essential shift towards a more security-conscious approach in the industry. Ongoing vigilance is required not only from manufacturers but also from end-users to protect their devices from such sophisticated infiltrations. The cybersecurity landscape continues to evolve, and proactive measures must be prioritized to stay ahead of potential threats.