Google and industry partners have disrupted a massive cybercrime operation that infected over 1.3 million Android-based devices with a malicious backdoor, creating a sprawling infrastructure for illicit activity. The botnet, known as XCPE, was allegedly run by Videostrong Technology Co., an Android device manufacturer, which deliberately embedded the malware in multiple device models and brands since at least 2024.
At the heart of the operation is a malicious backdoor that allows criminal affiliates to access compromised hardware and deploy their own malicious software. Videostrong monetized this access by selling it to affiliates, who then loaded modules onto infected devices designed for activities such as ad-fraud, enrolling devices into proxy networks, and installing additional malware. This setup has severe implications for consumer security, but also poses a significant threat to businesses and enterprise organizations.
The XCPE botnet primarily targeted Android TV set-top boxes, but also included other IoT devices like telehealth equipment, karaoke machines, and digital signage systems. The widespread exposure of these devices is reflected in recent research that recorded over 5.4 billion security events and 6.2 billion vulnerability observations across devices behind approximately 10.4 million monitored routers between January and September this year.
Google’s Threat Intelligence Group (GTIG) attributed the operation to Videostrong with “high confidence” after a thorough investigation. In collaboration with industry partners, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, Google took legal action against Videostrong to disrupt the domains and servers used to control the botnet and install affiliate malware modules.
The takedown has significant consequences for businesses. Compromised IoT equipment can be turned into criminal infrastructure, providing attackers with residential proxy networks that help conceal malicious activity, evade IP-based security controls, and facilitate fraud. Moreover, the XCPE operation demonstrates how easily consumer devices can be co-opted into supporting large-scale cybercrime.
Google has also severed ties with Videostrong, banning the manufacturer from building or selling certified Android devices and supplying software to other vendors. While this action is a major step forward in disrupting the botnet, it’s essential for businesses to take proactive measures to protect their IoT infrastructure from similar threats.
To mitigate the risks associated with compromised IoT equipment, organizations should implement robust security protocols, including regular device updates, network segmentation, and monitoring of suspicious activity. Moreover, businesses should prioritize transparency and communication with customers about potential vulnerabilities and security incidents affecting connected devices. By taking these steps, companies can minimize their exposure to the XCPE botnet and other similar threats.
Source: Dark Reading — 2026-11-04