[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2GtpdHDD-ZLQmyGJp5aFm4C8CgcJkH78gKSMOxzwgUc":3},{"article":4,"iocs":52,"watch_terms":66,"solutions":67,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"8b823ded-2a2b-4ea5-b1db-f6f9387c26d9","Google Dismantles 1.3 Million Device XCPE Botnet, Bans Android TV Maker Over Preinstalled Malware","google-dismantles-1-3-million-device-xcpe-botnet-bans-android-tv-maker-over-prei-ce4306","Google and industry partners have dismantled the XCPE botnet, which enrolled more than 1.3 million set-top boxes through preinstalled malware. In a November 2 report, Google linked the operation with high confidence to Videostrong Technology, accusing the Android device maker of deliberately building and running the backdoor for profit. According to Google’s technical investigation, Videostrong […] The post Google Dismantles 1.3 Million Device XCPE Botnet, Bans Android TV Maker Over Preinstalled Malware appeared first on Cyber Security News.","Google, with industry partners, has dismantled the XCPE botnet, which compromised over 1.3 million Android devices, primarily set-top boxes. The operation is linked to Videostrong Technology, an Android device maker accused of deliberately embedding malware for profit. Google has banned the company from producing certified Android devices and is enhancing its device review process.","Google dismantled the XCPE botnet, banning Android TV maker Videostrong for preinstalled malware.","https:\u002F\u002Fcybersecuritynews.com\u002Fgoogle-dismantles-xcpe-botnet\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGoogle-Dismantles-1.3-Million-Device-XCPE-Botnet.webp","2026-11-03T02:24:38+00:00","2026-11-03T03:00:36.559719+00:00",8,[17,20,23,26],{"name":18,"type":19},"XCPE","threat_actor",{"name":21,"type":22},"Videostrong Technology","vendor",{"name":24,"type":25},"Android TV boxes","product",{"name":27,"type":28},"MQTT","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60,63],{"type":54,"value":55,"context":56},"domain","mqtt.szbboys[.]com","XCPE botnet C2 server domain",{"type":33,"value":58,"context":59},"x.cpe","XCPE botnet backdoor name",{"type":33,"value":61,"context":62},"com.oemservice","XCPE botnet backdoor package name",{"type":33,"value":64,"context":65},"com.abc.nexus","XCPE botnet loader package name",[21,24],{"controls":68,"vendors":147},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[103,111,118],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":113,"url":116,"description":117},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":127,"name":128,"problem":129,"products":130},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[131,139],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"preinstalled-malware-in-android-tv-boxes-powers-13m-device-botnet","Preinstalled Malware in Android TV Boxes Powers 1.3M Device Botnet","The XCPE botnet demonstrates how hardware supply chain compromise can weaponize consumer devices at scale before they ever reach an end user. Videostrong Technology allegedly embedded malware deliberately into certified Android set-top boxes, meaning no user action or software vulnerability was required — the threat arrived pre-installed from the factory. This undermines the fundamental trust consumers place in certified hardware ecosystems and shows that device certification processes must include deeper firmware and software integrity checks. The scale of 1.3 million compromised devices illustrates how a single bad actor in the supply chain can create outsized harm across a global network.",[159,160,161,162,163,164,165],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1195: Supply Chain Compromise","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 13: Network Monitoring and Defense","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"CIS Control 15: Service Provider Management":169,"MITRE ATT&CK T1195: Supply Chain Compromise":170,"CIS Control 13: Network Monitoring and Defense":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires supply chain security measures including assessment of the security practices of direct suppliers; had operators applied this to hardware vendors like Videostrong, the malicious firmware could have been identified during procurement.","While the malware was preinstalled rather than a software flaw, SI-2's broader mandate to identify and remediate unauthorized code in information systems applies directly to detecting and removing embedded malware in firmware.","Videostrong was a certified third-party device manufacturer; formal vendor risk assessment and ongoing oversight of hardware suppliers would have scrutinized firmware integrity before devices reached consumers.","The deliberate embedding of malware by the device manufacturer is a textbook supply chain compromise at the hardware\u002Ffirmware level, which this ATT&CK technique specifically describes and for which defensive mitigations are documented.","Continuous network monitoring for anomalous outbound traffic from IoT devices would have detected botnet command-and-control communications far earlier, limiting the botnet's operational lifespan and scale.","This control requires organizations to assess vulnerabilities in software and firmware used within their environment, which would extend to vetting OEM firmware on procured hardware devices for embedded malicious code.","Stricter device identity and integrity verification during the Android certification process would have flagged Videostrong's devices as non-compliant before they were authorized to carry the certified Android label."]