Google Dismantles XCPE Botnet and Bans Videostrong

Executive Summary

On November 2, 2026, Google announced it had dismantled the XCPE botnet, a network of over 1.3 million compromised Android-based devices, primarily set-top TV boxes. In a significant move, Google's Threat Intelligence Group (GTIG) attributed the botnet's creation and operation with high confidence to the devices' own manufacturer, Videostrong Technology Co., a China-based Original Equipment Manufacturer (OEM). The XCPE malware was embedded in the device firmware, granting it system-level persistence and allowing Videostrong to sell access to the compromised devices to criminal affiliates. These affiliates used the botnet for activities like ad fraud and residential proxy services. Google has initiated legal action to take down command-and-control (C2) infrastructure and has banned Videostrong and its subsidiaries from the Android ecosystem.

Threat Overview

This incident represents a severe Supply Chain Attack where the manufacturer itself is the malicious actor. Videostrong intentionally pre-installed the XCPE malware onto the firmware of its Android devices, including set-top boxes, telehealth devices, and karaoke machines. This backdoor was designed to survive factory resets. The manufacturer monetized this access by selling it to affiliates who integrated the devices into proxy-as-a-service networks like Linkfog, AppSalt/Honeygain, and Traffmonetizer. This allowed criminals to route their malicious traffic through the IP addresses of unsuspecting users, obfuscating their activities. The scale of the operation is vast, with the C2 takedown expected to affect an additional 10 million devices controlled by affiliates.

Technical Analysis

The attack chain is rooted in the manufacturing process:

• Initial Access / Persistence: T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder. More accurately for this context, the malware was embedded directly into the firmware, a form of T1204 - User Execution where the 'user' is the manufacturer. The malware was loaded after the device's first boot to bypass security checks. This is a classic supply chain compromise, specifically T1195.003 - Compromise Software Supply Chain: Compromise Hardware Supply Chain.
• Defense Evasion: T1562.001 - Impair Defenses: Disable or Modify Tools. The malware was designed with system-level privileges, making it difficult for users to remove.
• Command and Control: T1071.001 - Application Layer Protocol: Web Protocols. The XCPE botnet communicated with C2 servers to receive instructions and download additional payloads.
• Impact: The primary goals were financial gain through T1499.001 - Endpoint Denial of Service: OS Exhaustion Flood (via ad fraud) and enabling other criminal activity by turning devices into proxy nodes (T1573.002 - Encrypted Channel: Asymmetric Cryptography).

Impact Assessment

The immediate impact is on the 1.3 million+ users whose devices were compromised. Their internet bandwidth was stolen, their devices were used for criminal activities without their knowledge, and they were exposed to further malware infections. The broader impact is a significant blow to trust in the Android IoT ecosystem. By banning Videostrong, Google is sending a strong message to other OEMs. The disruption of the C2 servers will neutralize the immediate threat from the XCPE botnet and its affiliates, but the underlying compromised firmware on devices in the wild may remain a latent risk if not updated.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify potentially compromised Android devices:

Detection & Response

• Network Monitoring: For enterprise or home networks, monitor outbound traffic from IoT devices. Block known residential proxy service domains and look for anomalous traffic patterns (D3-NTA).
• Device Inventory: Maintain an inventory of all connected devices. Identify any devices manufactured by Videostrong or its subsidiaries.
• End-user Response: Users with affected devices should disconnect them from the network. Since the malware is in the firmware, a factory reset is insufficient. The devices should be considered permanently compromised and replaced.

Mitigation

• Procurement Vetting: Enterprises and consumers should purchase hardware from reputable, well-known manufacturers. Conduct due diligence on the security practices of hardware suppliers.
• Firmware Updates: Always apply firmware updates from the manufacturer. However, in this case, the manufacturer was the source of the malware, highlighting the limitations of this approach when the supply chain is compromised.
• Network Segmentation: Isolate IoT devices, such as Android TV boxes, on a separate network segment with restricted internet access to limit their ability to communicate with C2 servers or act as proxies (D3-NI).
• Google's Actions: Google's ban of Videostrong is a form of supply chain mitigation (M1056 - Pre-compromise), preventing future compromised devices from entering the certified ecosystem.