AnswersPublished20 sources
Google’s XCPE Takedown Disrupted a 1.3 Million-Device Android Botnet
Google said its late October takedown disrupted XCPE, a botnet of more than 1.3 million devices, mostly Android TV boxes, and attributed the factory installed backdoor to Videostrong with high confidence.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Google said its late October takedown disrupted XCPE, a botnet of more than 1.3 million devices, mostly Android TV boxes, and attributed the factory installed backdoor to Videostrong with high confidence.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did Google announce on November 2 about its takedown the previous week of the XCPE botnet controlling more than 1.3 million mostly Andr. Article summary: On November 2, 2026, Google announced that it and industry partners had dismantled XCPE’s control infrastructure the previous week, disrupting a botnet of more than 1.3 million devices, mostly Android TV set-top boxes. G. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
Google announced on November 2, 2026, that it and industry partners had disrupted XCPE, a botnet linked to more than 1.3 million set-top boxes across more than 200 countries. Google said it assesses with high confidence that Shenzhen-based Videostrong Technology deliberately developed, deployed and operated the firmware backdoor for financial gain. 6
14
The operation cut off the botnet’s control infrastructure. It did not, however, establish that the backdoor had been removed from devices where it was already installed. 11
What Google said about Videostrong and XCPE
Google described XCPE as a backdoor embedded in device firmware and said Videostrong intentionally built and operated it. The company said Videostrong sold criminal affiliates access to infected devices; reporting on the operation describes uses including advertising fraud and routing traffic through victims’ internet connections as residential proxies. 6
7
That attribution is Google’s assessment, not a court finding described in the available sources. Google said it had cut ties with Videostrong and banned it from making devices with preloaded Google apps. 6
How the takedown worked—and its expected reach
The disruption involved Google, Lumen, HUMAN Security, Plume, Synthient, TrendAI and Japan’s National Police Agency. 14 Google said it used legal action to block domains and servers used to control XCPE. Reporting also describes action against command infrastructure used by more than a dozen malware families distributed through the backdoor.
3
5
Google assessed that taking down those domains could sever criminal access to at least 10 million additional compromised devices, beyond the more than 1.3 million associated with XCPE. That figure is an estimate of the wider impact, not a confirmed count of devices cleaned or repaired. 14
What the infection counts do—and don’t—show
TrendAI, Trend Micro’s enterprise business unit, reported telemetry identifying 1,472,554 infected devices across 206 models between June 3 and October 1, 2026. 9
25 That is a specific monitoring count; Google’s broader announcement described more than 1.3 million set-top boxes in the disrupted botnet.
6
14
The reporting also describes infections in devices beyond TV boxes, including telehealth equipment, karaoke machines and digital signage. 27
Why the takedown did not necessarily clean affected devices
Taking down a botnet’s control servers disrupts the criminals’ ability to communicate with infected devices. It does not, by itself, remove firmware already installed on those devices. Reporting on XCPE says the backdoor remained embedded after the servers went offline. 11
The distinction matters: the operation disrupted remote control, but the available sources do not establish that affected devices were made trustworthy again or provide a verified removal method. The takedown should not be read as confirmation that an infected box was cleaned. 11
17
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Google’s XCPE Takedown Disrupted a 1.3 Million-Device Android Botnet"?
Google said its late October takedown disrupted XCPE, a botnet of more than 1.3 million devices, mostly Android TV boxes, and attributed the factory installed backdoor to Videostrong with high confidence.