More than 1.3 million Android devices in over 200 countries were enrolled in a covert proxy network through a preinstalled backdoor called XCPE, security firms and Japan’s National Police Agency said after a coordinated disruption.
The coalition that pulled the plug
Private-sector security teams working with Japan’s National Police Agency carried out the disruption. Participants named by the firms include Google, Lumen, Human Security, Plume, Synthient, and TrendAI. Google’s Threat Intelligence Group (GTIG) led public attribution, stating in a blog that it “assess[es] with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology.”
How XCPE was built into devices
According to the firms’ reporting, Videostrong Technology — a Shenzhen-based hardware maker that manufactures Android home TV boxes and projectors — deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates. The firmware included a pre-installed management agent that, TrendAI said, “purported to be a standard remote-management client.”
That agent pulled updates from a GitHub page and connected to a Message Queuing Telemetry Transport (MQTT) server that gave operators full remote control of each box. From that foothold, operators could install and remove apps, change settings, and push updates to infected devices. Affiliates used that access to add additional malware modules and to create proxy networks that hid malicious traffic on customers’ home internet connections without their knowledge.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale observed and the takedown’s reach
GTIG and partners say XCPE formed a botnet of more than 1.3 million Android devices across more than 200 countries. TrendAI documented more than 3.8 million distinct home and mobile IP addresses connecting to the operation between June 3 and October 1, evidence of broad, ongoing use of customer networks to proxy traffic.
The coalition also seized or disrupted the command-and-control domains used to manage the affiliate modules. GTIG warned that because the affiliates “each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices.”
Consequences for Videostrong and the device ecosystem
Google said it has cut ties with Videostrong and banned the OEM from producing devices with preloaded Google apps. Videostrong did not immediately respond to inquiries from The Register. The operation sits in a broader ecosystem of infected TV boxes: the same private-sector teams previously disrupted BadBox 2.0, “another notorious botnet that infected more than 10 million TV boxes and other devices,” which Human, Google, and TrendAI disrupted in March 2025.
What this means for technologists, policymakers, and end users
- Technologists and security teams: will focus on the mechanics TrendAI detailed — a preinstalled management agent, GitHub-based update channels, and MQTT C2 — when hunting residual access and hardening device supply chains.
- Policymakers and regulators: will note the operational result Google enforced — an OEM ban on preloading Google apps — as an example of platform-level consequences tied to embedded firmware behavior.
- End users and procurement leaders: should take note that devices shipped with preinstalled firmware can carry persistent backdoors; in this incident those devices were used to proxy malicious traffic without users’ knowledge, according to the firms’ findings.
The disruption removes active C2 and affiliate management domains and severs direct control over the XCPE network, but GTIG’s own assessment points to a larger footprint: affiliates with separate distribution paths may have spread modules to many more devices. Google’s ban on Videostrong narrows one channel, and the public technical signals (GitHub update points, MQTT usage, IP telemetry) give defenders tangible artifacts to chase — but the firms’ reporting leaves a concrete practical question: with at least 10 million additional compromised devices estimated to be reachable through affiliates’ other channels, how quickly and thoroughly can those alternate networks be found and neutralized?
