X.CPE botnet: Videostrong Android TV boxes — preinstalled firmware backdoor turned 1.3M+ devices into residential proxy and malware platform (no CVE)
Severity: high · Patch status: partial · Since 2026-11-03
Google, TrendAI, Human, Synthient and Japanese law enforcement dismantled the X.CPE botnet hidden in firmware of 1.3M+ Android TV set-top boxes and other Android IoT devices across 200+ countries. Google attributes the campaign to Chinese OEM Videostrong Technology, which allegedly built the backdoor into firmware before shipping, sold access to criminal affiliates, and operated a residential proxy network monetized via bandwidth resale, ad fraud, data exfiltration and additional malware, evolving to a modular three-stage architecture since late 2024. The malware reinstalled itself if removed. Google seized command-and-control domains, effectively rendering the malware benign, cut ties with Videostrong and banned it from certified Android devices; affiliate takedowns may have cut off access to an additional 10M compromised devices. Google says it will change its review process; no user notification or forced-removal effort was announced.
What to do
- Check whether any Android TV boxes or Android IoT devices in your estate are Videostrong-manufactured OEM models and isolate or replace them
- Treat affected devices as compromised even after takedown: block their traffic, monitor for residual connections, and plan replacement since the malware self-reinstalls
- Review egress traffic for residential-proxy or ad-fraud patterns and unexpected bandwidth use from set-top boxes
- Do not factory-reset as remediation — the backdoor persists in firmware
- Track Google's guidance on notification or removal for infected devices
Sources
All live incidents on Threat Watch
