Police and security firms disrupt botnet of more than 1.3M Android devices

A coalition of private-sector security firms working with Japan's National Police Agency has disrupted XCPE, a backdoor used to build a botnet of more than 1.3 million Android devices across more than 200 countries. Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption. The Google Threat Intelligence Group said it assesses with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology.

What investigators found

Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge.

How the backdoor worked

The firmware's pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices.

Scale and disruption

Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. The coalition also disrupted the command-and-control domains used to manage the affiliate modules. Because these affiliates each have diversified distribution channels for their modules beyond XCPE, GTIG said taking down their C2 domains will sever access to at least 10 million additional compromised devices.

Aftermath and related botnet

Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps. Videostrong did not immediately respond to The Register's inquiries. This backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another notorious botnet that infected more than 10 million TV boxes and other devices before Human, Google, and TrendAI disrupted it in March 2025.

Sources: The Register