{"id":822302,"date":"2026-11-03T01:56:15","date_gmt":"2026-11-03T01:56:15","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/822302\/"},"modified":"2026-11-03T01:56:15","modified_gmt":"2026-11-03T01:56:15","slug":"cops-bust-botnet-of-1-3m-infected-android-tv-boxes","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/822302\/","title":{"rendered":"Cops bust botnet of 1.3M infected Android TV boxes"},"content":{"rendered":"

<\/p>\n

\n cyber-crime\n <\/p>\n

<\/a><\/p>\n

\n Videostrong accused of shipping devices with a backdoor baked in\n <\/p>\n

A coalition of private-sector security firms working with Japan\u2019s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries.<\/p>\n

Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption.<\/p>\n

\u201cWe assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,\u201d the Google Threat Intelligence Group (GTIG) said<\/a> in a Monday blog.<\/p>\n

Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates<\/a>, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks<\/a> and hide malicious traffic<\/a> using the customers’ internet connections without their knowledge.<\/p>\n

The firmware\u2019s pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices.<\/p>\n

Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses<\/a> connected to the operation.<\/p>\n

The coalition also disrupted the command-and-control domains used to manage the affiliate modules. \u201cBecause these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices,\u201d according to GTIG.\u00a0<\/p>\n

Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps.\u00a0<\/p>\n

Videostrong did not immediately respond to The Register\u2019s inquiries.<\/p>\n

This backdoor and botnet operation is part of the same ecosystem as BadBox 2.0<\/a>, another notorious botnet that infected more than 10 million<\/a> TV boxes and other devices before Human, Google, and TrendAI\u00a0disrupted it<\/a> in March 2025.\u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"cyber-crime Videostrong accused of shipping devices with a backdoor baked in A coalition of private-sector security firms working…\n","protected":false},"author":2,"featured_media":822303,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[59,86,56,54,55],"class_list":["post-822302","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-gb","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/822302","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=822302"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/822302\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/822303"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=822302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=822302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=822302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}