Google Disrupts XCPE Botnet Embedded in Android Devices

Google and industry partners disrupted the XCPE botnet, which researchers say was built into more than 1.3 million Android devices sold by Videostrong Technology Co. The China-based Android original equipment and device manufacturer allegedly implanted backdoors in multiple device models over several years. Most identified devices were Android TV set-top boxes, but researchers also found infected telehealth devices, karaoke machines, and digital signs. For government buyers and contractors, the case demonstrates how threats can enter through commercially available connected equipment, including products that may appear to have passed platform security checks.

According to the reporting, the backdoors established a botnet used by cybercriminals for ad fraud, data theft, and routing malicious traffic through residential proxy networks. Google also disrupted command-and-control domains used by more than a dozen malware families operating through the XCPE backdoor, cutting off access to at least 10 million additional compromised devices from various manufacturers. Google took legal action to shut down domains and servers used to control the botnet. The broader disruption therefore went beyond the devices attributed directly to Videostrong and highlights the potential reach of shared malware infrastructure.

The incident has direct implications for public-sector device procurement and contractor-led deployments. Evaluating a product at acquisition is not enough if malicious code can be introduced after initial startup or evade pre-deployment checks. Google said Videostrong’s malware was loaded after a device’s first boot, and that the operators repeatedly changed configurations to avoid detection. As Charley Snyder, head of disruption operations at the Google Threat Intelligence Group, told CyberScoop: “The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections.” Buyers and integrators should therefore consider manufacturer vetting, firmware provenance and integrity, secure configuration, update practices, and continuing monitoring as connected-device lifecycle requirements.

Google banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process to detect and stop similar activity. The company did not disclose the details of those changes, with Snyder explaining that revealing specifics could help threat actors circumvent the protections. Researchers said the campaign did not appear to be an isolated rogue-insider incident or development oversight; they found malicious software across multiple models and brands over multiple years, supported by dedicated infrastructure and evolving configurations. The botnet reportedly spanned more than 170 countries. TrendAI researchers identified the largest concentrations in Malaysia, Brazil, Iraq, Mexico, and Taiwan, and nearly 44,000 infected devices in the United States between June and October. This is a cybersecurity development, not a solicitation or contract award, but it offers a concrete risk signal for agencies and contractors managing connected-device supply chains.

• Videostrong Technology Co. allegedly embedded backdoors in more than 1.3 million Android devices, including TV set-top boxes and other connected equipment.
• Google and partners disrupted XCPE control infrastructure, while legal action targeted domains and servers used to operate the botnet.
• The operation also disrupted command-and-control access associated with malware affecting at least 10 million additional devices from various manufacturers.
• Reported malicious uses included ad fraud, data exfiltration, and routing malicious network traffic through residential proxy networks.
• Researchers found affected Android-based telehealth devices, karaoke machines, and digital signs as well as TV set-top boxes.
• Videostrong reportedly evaded security testing by loading malicious code after devices’ first boot; procurement reviews should address firmware integrity and post-deployment changes.
• Google banned Videostrong and future subsidiaries from building or selling certified Android devices and said it modified its review process, without disclosing implementation details.
• The botnet reportedly operated across more than 170 countries; nearly 44,000 infected devices were in the United States between June and October.
• Lumen Technologies, Plume, and Synthient worked with Google on research and disruption; the source describes a security action, not a specific procurement opportunity.
• Government buyers and integrators should assess manufacturer trust, firmware provenance, secure update mechanisms, and ongoing monitoring for connected-device deployments.