Google has announced the dismantling of the XCPE botnet, which comprised over 1.3 million infected Android TV set-top boxes, a move that is expected to disrupt access to an additional 10 million compromised devices. This botnet, linked to advertising fraud, was reportedly facilitated by malicious software embedded in devices manufactured by Videostrong Technology Co., a Chinese company. The Google Threat Intelligence Group (GTIG) confirmed that the malware allowed the rental of users’ internet connections to third parties without their consent.
Details of the XCPE Botnet
The XCPE botnet operated by loading software onto users’ devices that made their internet addresses available for resale through various “residential proxy” services. These services are often exploited for malicious activities, including account takeovers and advertising fraud. The GTIG report highlighted that Videostrong not only monetized the backdoor access but also facilitated the installation of additional malware on the infected devices.
While the majority of the botnet consisted of TV boxes, the same XCPE malware was also discovered in other Android-based IoT products, such as telehealth devices and karaoke machines. Google stated that it has since addressed the vulnerability that allowed Videostrong to load its malicious software during the initial boot-up of these devices.
Legal and Industry Responses
In response to the botnet’s activities, Google has taken legal action to dismantle the domains and servers used by Videostrong to control the botnet. The GTIG report emphasized the breach of trust involved in a device manufacturer intentionally infecting users with malware, which poses significant risks to those users.
Several residential proxy providers were identified as being linked to the XCPE botnet, including AppSalt (also known as Honeygain) and NetNut. The latter was previously associated with another botnet, Popa, which also exploited TV boxes as residential proxies. The FBI had previously seized domains related to NetNut in July 2026, indicating ongoing law enforcement efforts against such malicious infrastructure.
Broader Implications and Future Risks
The GTIG report suggests that the takedown of the XCPE botnet may only be the beginning, as the various proxy and ad fraud affiliates of Videostrong have diversified distribution channels for their malware. Synthient, a startup tracking proxy providers, echoed this sentiment, indicating that the actual number of affected devices could be significantly higher than the reported 1.3 million.
As the landscape of IoT devices continues to expand, the risks associated with compromised devices remain a pressing concern. The XCPE botnet incident serves as a stark reminder of the vulnerabilities inherent in consumer electronics and the potential for exploitation by malicious actors.
For further insights into the XCPE botnet and its implications, refer to the detailed report by the Google Threat Intelligence Group and additional analyses from industry experts.
For more information, see the original report on Krebs on Security.
