Cops bust botnet of 1.3M infected Android TV boxes
Law enforcement disrupts XCPE botnet of 1.3M Android TV boxes with backdoor allegedly pre-installed by Videostrong.
A coalition including Google, Lumen, and Human Security disrupted XCPE, a backdoor infecting over 1.3 million Android devices across 200+ countries. Videostrong Technology, a Chinese hardware manufacturer, allegedly intentionally embedded the backdoor in device firmware and sold access to criminal affiliates, enabling them to create proxy networks and install additional malware. The disruption severed C2 domains believed to control at least 10 million additional compromised devices.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Chinese hardware manufacturer allegedly embedded a backdoor directly into Android TV box firmware before sale, meaning devices arrived compromised out of the box — a textbook supply chain attack. This matters because no amount of end-user patching or antivirus software can reliably detect or remediate malicious code baked into device firmware by the manufacturer. The scale — 1.3 million confirmed infected devices and potentially 10 million more — demonstrates how a single poisoned supply chain node can create infrastructure for global cybercrime. Organizations and consumers purchasing low-cost, off-brand IoT hardware from unvetted manufacturers face this risk acutely, as procurement decisions effectively become security decisions.
What helps against this
How we list vendors
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — XCPE
- malware — BadBox 2.0