UK — The Register
Cops bust botnet of 1.3M infected Android TV boxes
Security2 min read
Police and security firms have shut down XCPE, a hidden backdoor that controlled a botnet of more than 1.3 million Android devices. A botnet is a group of hacked devices that a criminal can control at once. The Chinese hardware maker Videostrong Technology is accused of building the backdoor on purpose.
What happened
A group of security companies worked with Japan's National Police Agency to disrupt XCPE. XCPE is a backdoor, which is a secret way into a device that lets someone take control without permission. The backdoor was used to build a botnet across more than 200 countries. Google says Videostrong Technology, a hardware maker in Shenzhen, China, put the backdoor into its devices and made money by selling access to criminals.
Key numbers and facts
- More than 1.3 million Android devices were infected.
- Devices were found in more than 200 countries.
- Between June 3 and October 1, TrendAI saw more than 3.8 million home and mobile IP addresses connected to the operation.
- Google says taking down related control domains could cut off at least 10 million more compromised devices.
How the attack worked
Videostrong put the XCPE backdoor into the device software before shipping. When a buyer plugged the box into their home network, criminals could use the box to hide harmful internet traffic. This traffic used the customer's own internet connection, and the customer did not know. The device also pulled updates from a GitHub page and connected to a control server. This let the operator install or remove apps, change settings, and push updates.
Why it matters
Many people buy cheap TV boxes without knowing they may already carry malware. Their home internet can then be used for crime, and their devices can be taken over. Google has cut ties with Videostrong and banned it from making devices with Google apps. This operation is also linked to BadBox 2.0, a older botnet that infected more than 10 million devices before it was disrupted in March 2025.
What to watch
- Whether Videostrong responds to the accusations. It did not reply right away to The Register.
- Whether criminals rebuild the botnet using other malware modules.
- Whether more infected TV boxes are found and cleaned up.
Glossary
- Videostrong Technology
- A hardware maker in Shenzhen, China, that builds Android TV boxes and projectors.
- BadBox 2.0
- An older botnet that infected more than 10 million TV boxes and other devices before it was disrupted in March 2025.