Google has dismantled a botnet that affected more than 1.3 million Android devices, most of them TV set-top boxes, after concluding that Shenzhen-based manufacturer Videostrong Technology deliberately embedded a backdoor in its firmware. Google has also barred the company, along with any future subsidiaries or affiliates, from making or selling certified Android devices or supplying software to other certified manufacturers.
The operation targeted the infrastructure behind the botnet, which Google calls XCPE. Google said it used legal process to seize control of the servers and domains associated with the operation. The company estimates that the action has cut off access to at least 10 million additional infected devices, although the number of devices confirmed by security researchers is lower.
TrendAI identified 1,472,554 infected units across 206 models between June and October. Google said the devices were spread across multiple models and brands over several years, rather than being linked to a single isolated manufacturing incident. The company’s investigation involved Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” Google Threat Intelligence Group said in a blog post.
How the Android TV backdoor operated
Google said the malware, tracked as x.cpe, was placed in the firmware as a system application with system-level privileges. It contacted command-and-control servers and waited for instructions. According to the company, the backdoor could disable Play Protect, install applications without the user’s permission and remain on a device even after a factory reset.
The operation therefore went beyond unwanted advertising or ordinary pre-installed software. A factory reset, which is commonly used to return a smart device to its default state, would not remove the backdoor described by Google. The company also said Videostrong had obfuscated the code to evade certification testing, indicating that the software was designed to avoid detection during the approval process.
- Backdoor: x.cpe, installed as a system app in device firmware
- Confirmed scale: 1,472,554 units across 206 models counted by TrendAI
- Device category: Android devices, mostly TV set-top boxes
- Capabilities identified by Google: disabling Play Protect, silently installing apps and surviving factory resets
- Google’s action: seizure of control infrastructure and a ban on Videostrong from the certified Android device programme
What the action means for Android TV users
The incident places attention on the firmware and certification chain behind low-cost connected TV products. An Android TV box can appear to function normally while system software operates with privileges that are not visible to the owner. In this case, Google said the code was present across multiple models and brands, which makes the issue broader than a single retail product name.
For users in India, the findings are relevant because Android-based TV boxes are sold through a range of channels and may not all have the same certification status. The reported figures also should not be treated as a count of affected Indian devices.
Google’s decision addresses Videostrong’s participation in its certified-device ecosystem and the infrastructure used to control the botnet. It does not, by itself, establish that every Android TV box made by the company is affected or that existing devices will be automatically repaired. The company’s account instead shows why firmware provenance, certification and the ability to receive trustworthy system updates matter when connected devices are used for streaming and other online services.
