--- title: Cops bust botnet of 1.3M infected Android TV boxes description: A coalition of security firms and Japan's National Police Agency disrupted the XCPE backdoor, which powered a botnet of more than 1.3 million Android devices... canonical: https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cops bust botnet of 1.3M infected Android TV boxes | daily.dev og:description: A coalition of security firms and Japan's National Police Agency disrupted the XCPE backdoor, which powered a botnet of more than 1.3 million Android devices... og:url: https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2 og:image: https://api.daily.dev/og/posts/c8w2STdw2.png og:image:alt: Cops bust botnet of 1.3M infected Android TV boxes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cops bust botnet of 1.3M infected Android TV boxes **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary A coalition of security firms and Japan's National Police Agency disrupted the XCPE backdoor, which powered a botnet of more than 1.3 million Android devices across over 200 countries. Google, Lumen, Human Security, Plume, Synthient, and TrendAI took part. Google says Videostrong Technology, a Shenzhen hardware maker, deliberately embedded the backdoor in firmware and sold access to criminal affiliates who ran proxy networks through victims' home connections. TrendAI tracked over 3.8 million distinct IPs tied to the operation between June 3 and October 1. Taking down the affiliates' command-and-control domains is expected to sever access to at least 10 million more compromised devices. Google has cut ties with Videostrong and banned it from preloading Google apps. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the XCPE botnet and how did it infect Android TV boxes? XCPE is a backdoor allegedly built into firmware by Chinese manufacturer Videostrong Technology, which makes Android TV boxes and projectors. It was embedded before devices shipped, so customers were infected as soon as they connected the devices to their home network. A disguised remote-management client pulled updates from GitHub and connected to an MQTT server giving operators full remote control, letting them install apps, change settings, and build proxy networks using victims' internet connections without consent. _Track how supply-chain backdoors in IoT devices get discovered and dismantled with daily.dev._ ### How many devices were affected by the XCPE Android TV botnet takedown? More than 1.3 million Android devices across over 200 countries were infected with the XCPE backdoor. TrendAI documented over 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1. Taking down the affiliates' command-and-control domains is expected to cut off access to at least 10 million additional compromised devices beyond the core botnet. _Developers weighing IoT security risk can follow botnet disruption scale and tactics on daily.dev._ ### Is the XCPE botnet related to BadBox 2.0? Yes, the XCPE backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another botnet that infected more than 10 million TV boxes and other devices before Human Security, Google, and TrendAI disrupted it in March 2025. Google has since cut ties with Videostrong Technology and banned it from shipping devices preloaded with Google apps. _Anyone tracking recurring Android device botnets can follow related takedowns on daily.dev._ ## Similar posts on daily.dev - [Is Your Android TV Streaming Box Part of a Botnet? – Krebs on Security](https://daily.dev/posts/is-your-android-tv-streaming-box-part-of-a-botnet-krebs-on-security-kajzwi9lv) · Krebs on Security · 0 upvotes · 0 comments - [Google and FBI Dismantle NetNut Residential Proxy Botnet](https://daily.dev/posts/google-and-fbi-dismantle-netnut-residential-proxy-botnet-iusqk4knt) · Latest Hacking News · 8 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#google](https://daily.dev/tags/google), [#android](https://daily.dev/tags/android) [View this post on daily.dev](https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cops bust botnet of 1.3M infected Android TV boxes","url":"https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2"},"datePublished":"2026-11-02T19:07:59.012Z","dateModified":"2026-11-02T19:13:06.266Z","description":"A coalition of security firms and Japan's National Police Agency disrupted the XCPE backdoor, which powered a botnet of more than 1.3 million Android devices...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a91c7c0eb51d4c5d305c536449424b13?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a91c7c0eb51d4c5d305c536449424b13?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,google,android","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Cops bust botnet of 1.3M infected Android TV boxes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cops-bust-botnet-of-1-3m-infected-android-tv-boxes-c8w2stdw2#faq","mainEntity":[{"@type":"Question","name":"What is the XCPE botnet and how did it infect Android TV boxes?","acceptedAnswer":{"@type":"Answer","text":"XCPE is a backdoor allegedly built into firmware by Chinese manufacturer Videostrong Technology, which makes Android TV boxes and projectors. It was embedded before devices shipped, so customers were infected as soon as they connected the devices to their home network. A disguised remote-management client pulled updates from GitHub and connected to an MQTT server giving operators full remote control, letting them install apps, change settings, and build proxy networks using victims' internet connections without consent. Track how supply-chain backdoors in IoT devices get discovered and dismantled with daily.dev."}},{"@type":"Question","name":"How many devices were affected by the XCPE Android TV botnet takedown?","acceptedAnswer":{"@type":"Answer","text":"More than 1.3 million Android devices across over 200 countries were infected with the XCPE backdoor. TrendAI documented over 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1. Taking down the affiliates' command-and-control domains is expected to cut off access to at least 10 million additional compromised devices beyond the core botnet. Developers weighing IoT security risk can follow botnet disruption scale and tactics on daily.dev."}},{"@type":"Question","name":"Is the XCPE botnet related to BadBox 2.0?","acceptedAnswer":{"@type":"Answer","text":"Yes, the XCPE backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another botnet that infected more than 10 million TV boxes and other devices before Human Security, Google, and TrendAI disrupted it in March 2025. Google has since cut ties with Videostrong Technology and banned it from shipping devices preloaded with Google apps. Anyone tracking recurring Android device botnets can follow related takedowns on daily.dev."}}]} ```