More than 1.3 million Android devices, most of them TV set‑top boxes, lost contact with the servers that controlled a long‑running botnet after Google led a legal takedown in late October, Google says.
The x.cpe backdoor and how it operated
According to Google's analysis, the malware — a firmware‑level backdoor dubbed x.cpe — was built into device images and runs as a system app with system‑level privileges. The backdoor reported to command‑and‑control (C2) servers, awaited orders and, critically, disabled Google Play Protect app checks before installing software silently.
Google says operators used x.cpe to install apps without owner knowledge, run commands, capture live screenshots, send keystrokes, copy account details, enumerate apps and system logs, open reverse shells and map devices' local networks. Most of the add‑on modules loaded through the backdoor converted boxes into residential proxies or ran ad‑fraud modules that faked views of online ads.
How Google and partners disrupted the botnet
Google used legal action to take down the domains and servers controlling the botnet and to disrupt control domains for more than a dozen malware families that had been loaded through the backdoor. The company says it is highly confident that device maker Videostrong intentionally put the backdoor in its boxes and sold access to criminals, and that the presence of x.cpe was not the result of a rogue insider or a mistake.
Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI on the operation. Google has also banned Videostrong — and any future subsidiaries or affiliates — from building or selling certified Android devices and from supplying software to other certified device makers. Google says it has changed its review process and is improving checks of firmware on certified Android TV devices.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale, distribution and identification
TrendAI (Trend Micro's enterprise unit) counted 1,472,554 infected devices across 206 models between June 3 and October 1 and says the real number is at least that high. Countries with the most infected devices included Malaysia, Brazil, Iraq, Mexico and Taiwan; the U.S., Germany, the U.K., Australia and Canada each had roughly 26,000 to 42,000 infected boxes.
Google and collaborators tied the campaign to Videostrong through several signals: x.cpe passed settings to other Videostrong apps including a YokaTV Player streaming app; a GitHub account that hosted botnet packages used the name yf‑videostrong; Synthient found a document signed by Videostrong's research and development director in an open folder on a botnet server; and a Videostrong web domain shared an IP address with the operators' control panel. Plume reported that Videostrong supplied firmware and remote‑management tools for affected devices.
What owners and organizations can (and cannot) do
Because x.cpe is embedded in the firmware and signed with the maker's key, Google and partners say owners cannot remove it permanently themselves: it reinstalls on reboot and ordinary cleanup does not stick. TrendAI says effective remediation requires vendor action, platform protections or device replacement.
- Synthient published a list of 182 device model names seen in the campaign and warns a model name alone does not confirm infection; it recommends using those indicators to locate MECOOL or similar devices on networks, disconnecting and discarding confirmed boxes, blocking listed control domains and IPs, and segmenting other smart devices away from sensitive systems.
- Plume recommends a full factory reset because additional modules may have installed further backdoors, but does not state whether a reset removes x.cpe itself.
- Synthient goes further for consumers, telling owners to throw affected boxes away because they pose a high risk of malware. TrendAI advises companies with remote staff to treat unmanaged consumer devices on home networks as part of their attack surface and to keep corporate access behind managed devices.
What this means for Videostrong, device makers, and enterprises
For Videostrong: Google has cut ties and banned the company from participating in the certified Android device ecosystem; yet, as of November 2, Videostrong's website still listed products labeled "Google Certified Android TV Box" and "Google Certified Android TV Stick."
For other device makers: Google has said it will tighten its firmware review checks for certified Android TV devices after investigators found Videostrong hid code to bypass existing tests and loaded malicious code after a device's first boot.
For enterprises and service providers: the takedown removed active C2 infrastructure, but Google cautioned that the criminals behind the modules also spread them via other vectors and that operators and buyers quickly switch tools when one part of their setup is disrupted. Google expects the action to cut off operators' access to at least 10 million additional infected devices that received the malware by other means.
The takedown severed live control of a very large botnet, but it did not erase a firmware‑level backdoor that remains on devices and resists user removal. The central technical and operational fact the record leaves open is straightforward: can vendor remediation, platform protections or device replacement be delivered at the scale required to make those millions of compromised boxes harmless?
