[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-pIZwhWXcBdYo5sUSrrNOuCNEtXZzjWftBCbDYr6fsM":3},{"article":4,"iocs":53,"watch_terms":60,"solutions":61,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"64671b92-cfaa-444e-80f5-1afc679175eb","Cops bust botnet of 1.3M infected Android TV boxes","cops-bust-botnet-of-1-3m-infected-android-tv-boxes-8c147c","Videostrong accused of shipping devices with a backdoor baked in","A coalition including Google, Lumen, and Human Security disrupted XCPE, a backdoor infecting over 1.3 million Android devices across 200+ countries. Videostrong Technology, a Chinese hardware manufacturer, allegedly intentionally embedded the backdoor in device firmware and sold access to criminal affiliates, enabling them to create proxy networks and install additional malware. The disruption severed C2 domains believed to control at least 10 million additional compromised devices.","Law enforcement disrupts XCPE botnet of 1.3M Android TV boxes with backdoor allegedly pre-installed by Videostrong.","https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F11\u002F02\u002Fcops-bust-botnet-of-13m-infected-android-tv-boxes\u002F5307045","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5307057&width=800","2026-11-02T19:03:31+00:00","2026-11-02T20:00:16.255894+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Videostrong Technology","vendor",{"name":21,"type":19},"Google",{"name":23,"type":19},"TrendAI",{"name":25,"type":19},"Human Security",{"name":27,"type":28},"Android TV boxes","product",{"name":30,"type":31},"MQTT (Message Queuing Telemetry Transport)","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57],{"type":36,"value":55,"context":56},"XCPE","Backdoor pre-installed in Videostrong Android TV box firmware, used to build 1.3M+ device botnet",{"type":36,"value":58,"context":59},"BadBox 2.0","Related botnet from same ecosystem; infected 10M+ TV boxes, disrupted March 2025",[21,18,23],{"controls":62,"vendors":141},[63,91,112],{"slug":64,"name":65,"problem":66,"products":67},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":86,"url":89,"description":90},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":92,"name":93,"problem":94,"products":95},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[96,104],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[142],{"slug":143,"name":21,"logo_path":144,"roles":145},"google","\u002Fvendor-logos\u002Fgoogle.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"intentional-firmware-backdoor-turns-13m-android-tv-boxes-into-criminal-botnet","Intentional Firmware Backdoor Turns 1.3M Android TV Boxes Into Criminal Botnet","A Chinese hardware manufacturer allegedly embedded a backdoor directly into Android TV box firmware before sale, meaning devices arrived compromised out of the box — a textbook supply chain attack. This matters because no amount of end-user patching or antivirus software can reliably detect or remediate malicious code baked into device firmware by the manufacturer. The scale — 1.3 million confirmed infected devices and potentially 10 million more — demonstrates how a single poisoned supply chain node can create infrastructure for global cybercrime. Organizations and consumers purchasing low-cost, off-brand IoT hardware from unvetted manufacturers face this risk acutely, as procurement decisions effectively become security decisions.",[152,153,154,155,156,157,158],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":160,"MITRE ATT&CK T1566: Phishing":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 15: Service Provider Management":163,"CIS Control 13: Network Monitoring and Defense":164,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":165,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":166},"NIS2 explicitly requires supply chain security measures including policies on secure procurement and relationships with suppliers, which would mandate the kind of firmware provenance checks that could have caught or deterred this embedded backdoor.","More precisely, this maps to MITRE ATT&CK T1195 (Supply Chain Compromise), where adversaries compromise hardware or software before it reaches the end user — exactly the attack vector used by embedding the backdoor in factory firmware.","While this incident involves intentional malice rather than an accidental flaw, SI-2's requirement to verify software and firmware integrity from suppliers directly addresses the need to validate that firmware has not been tampered with before deployment.","The hardware manufacturer was an unvetted third-party supplier; rigorous supplier security assessments and contractual firmware-integrity requirements would have identified or deterred the intentional backdoor before devices reached consumers.","Continuous network traffic analysis would have detected the anomalous outbound C2 beacon and proxy traffic patterns generated by compromised devices, enabling earlier discovery and isolation of infected units.","Organisations managing IoT fleets must assess vulnerabilities — including malicious firmware — in supplied hardware; this control requires a systematic process for identifying and addressing such risks across the asset lifecycle.","The backdoor created unauthorised network proxy access; enforcing strict network access controls and device identity verification would have limited the ability of compromised boxes to establish and maintain C2 communications."]