Google has disrupted a massive Android botnet involving more than 1.3 million infected devices, most of them Android TV set-top boxes, following a coordinated takedown operation in late October.
According to Google, the botnet relied on a firmware-level backdoor called x.cpe, which was allegedly embedded in devices manufactured by China-based Videostrong. The company reportedly supplied devices under its own brand as well as for other manufacturers.
Google said it has high confidence that Videostrong deliberately incorporated the backdoor into multiple device models over several years and provided criminals with access to the compromised infrastructure.
Cybercriminals exploited the infected devices for advertising fraud and residential proxy services, allowing third parties to route internet traffic through unsuspecting users’ home connections.
Although Google successfully disrupted the botnet’s command infrastructure, the company warned that the backdoor remains installed on affected devices. Users cannot permanently remove it through conventional cleanup methods.
Google Leads Operation to Disrupt Android Botnet
Google used legal action to seize or disrupt the domains and servers responsible for controlling the botnet.
The operation also targeted the command infrastructure associated with more than a dozen malware families distributed through the x.cpe backdoor.
Several organizations supported the takedown, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
Google believes the disruption could also prevent cybercriminals from accessing at least 10 million additional infected devices because the malware families involved in the campaign were distributed through other infection methods.
However, the company cautioned that cybercriminals frequently adapt their infrastructure and switch to alternative tools when security researchers disrupt their operations.
Google has also terminated its relationship with Videostrong. The company and any future subsidiaries or affiliates are prohibited from manufacturing or selling certified Android devices or supplying software to other manufacturers of certified Android devices.
What Is the x.cpe Android Backdoor?
The x.cpe backdoor is embedded directly into the firmware of affected Android devices and operates as a system application with elevated privileges.
According to Google’s technical analysis, the malware communicates with remote command-and-control (C2) servers and waits for instructions from its operators.
One of its capabilities involves disabling application security checks enforced by Google Play Protect, allowing attackers to install applications without the device owner’s knowledge.
Through the backdoor, attackers could remotely:
- Install applications without user approval.
- Execute commands on infected devices.
- Capture screenshots of device activity.
- Monitor keystrokes.
- Collect account information and device details.
- Retrieve installed application lists and system logs.
- Map networks connected to compromised devices.
- Establish reverse shell connections for remote command execution.
Google said it observed operators using several of these capabilities during the investigation.
In particular, the attackers captured live screenshots, recorded keystrokes, collected account-related information, extracted device details and system logs, and opened reverse shells to gain remote command-line access.
These capabilities gave the operators extensive control over infected Android devices and potentially exposed sensitive information belonging to their owners.
Android TV Boxes Turned Into Residential Proxy Networks
Most of the malicious modules distributed through the backdoor were designed to monetize infected devices.
One major use involved converting compromised Android TV boxes into residential proxy nodes.
Residential proxy services allow customers to route internet traffic through ordinary household internet connections. As a result, online services see the traffic as originating from residential IP addresses rather than conventional data centers.
Cybercriminals can abuse these networks for various activities, including hiding their real locations and disguising automated internet traffic.
Other malware modules were designed to sell unused internet bandwidth or carry out advertising fraud by generating fake views and interactions with online advertisements.
Although Android TV set-top boxes accounted for most infections, researchers also discovered the backdoor on other connected products, including:
- Telehealth devices.
- Karaoke machines.
- Digital signage systems.
- Various Android-based consumer devices.
This highlights the potential risks associated with inexpensive smart devices that receive little security oversight after being sold.
More Than 1.47 Million Infected Devices Identified
TrendAI, the enterprise cybersecurity division of Trend Micro, identified 1,472,554 infected devices across 206 different models between June 3 and October 1.
Researchers warned that the actual number of compromised devices could be even higher.
The largest concentrations of infected devices were identified in:
- Malaysia
- Brazil
- Iraq
- Mexico
- Taiwan
The United States, Germany, the United Kingdom, Australia, and Canada also had significant numbers of infected devices, with approximately 26,000 to 42,000 infections reported in each country.
The findings demonstrate the international reach of the operation and the risks posed by compromised consumer electronics connected to residential networks.
Which Android TV Boxes Could Be Affected?
Synthient, a cybersecurity company specializing in tracking botnets and proxy networks, published a list of 182 device model names associated with the campaign.
However, researchers emphasized that a device’s model name alone does not confirm that it contains the x.cpe backdoor.
The investigation particularly focused on MECOOL-branded Android TV boxes, which researchers linked to Videostrong.
Synthient purchased a MECOOL KM9PRO Max device and discovered that the backdoor was already installed in its firmware.
Plume, which provides Wi-Fi software and security solutions to internet service providers, also identified more than a dozen device models communicating with the botnet’s command infrastructure. Most of the identified devices carried the MECOOL brand.
Consumers should therefore avoid assuming that every device from a particular manufacturer is infected. The findings indicate that affected models require further verification.
Factory Reset May Not Remove the Android Backdoor
One of the most concerning aspects of the discovery is that users cannot reliably remove x.cpe through ordinary device cleanup procedures.
Because the malware is embedded in the firmware as a system application, deleting suspicious applications or performing a standard cleanup may not permanently eliminate it.
TrendAI explained that the backdoor is signed with the device manufacturer’s key and operates as part of the system software.
As a result, permanently addressing the issue requires action from the device vendor, platform-level protection, or replacement of the affected hardware.
Plume recommends performing a complete factory reset because additional malicious modules may have installed other backdoors. However, this recommendation does not establish that a factory reset removes x.cpe itself.
Synthient takes a stricter position, advising consumers to permanently dispose of affected devices because of the security risks associated with the preinstalled backdoor.
Security Recommendations for Consumers and Businesses
For consumers, the most important concern is that affected devices may continue communicating with malicious infrastructure even after the botnet’s main control servers have been disrupted.
Users who suspect their Android TV boxes are affected should avoid relying solely on a factory reset and seek manufacturer guidance or replace the device.
Organizations should also take additional precautions to prevent compromised consumer electronics from becoming an entry point into corporate networks.
Synthient recommends the following security measures:
- Identify potentially affected devices: Use published indicators and device information to identify MECOOL and other potentially compromised hardware connected to corporate networks.
- Disconnect compromised devices: Remove confirmed infected devices from network access and replace them.
- Block malicious infrastructure: Use the control domains and IP addresses published in the security research to strengthen network filtering.
- Segment connected devices: Keep smart TVs, entertainment systems, and other consumer IoT devices on separate network segments away from sensitive business infrastructure.
TrendAI also advises organizations to treat unmanaged consumer devices connected to employees’ home networks as part of their broader attack surface.
Companies should ensure that corporate systems and sensitive resources can only be accessed through properly managed and secured devices.
How Researchers Linked Videostrong to the Botnet
Google and its research partners identified several connections between Videostrong and the infrastructure used to operate the x.cpe backdoor.
According to Google, x.cpe communicates configuration information from command-and-control servers to other applications developed by Videostrong, including its YokaTV Player streaming application.
Researchers also identified a GitHub account named yf-videostrong that hosted packages associated with the botnet.
Synthient, which collaborated with Google during the investigation, independently concluded with high confidence that Videostrong was responsible for operating the campaign.
Its findings included a document signed by Videostrong’s research and development director that was discovered in an openly accessible directory on one of the botnet’s servers.
Researchers also identified a Videostrong-related web domain sharing an IP address with the operators’ control panel.
Meanwhile, Plume found that Videostrong supplied both the firmware used by the affected devices and tools designed to manage them remotely.
Together, these findings formed the basis for Google’s attribution of the operation to Videostrong.
Google Identifies a Security Testing Gap in Android Certification
The investigation also exposed weaknesses in the security testing process used for certified Android devices.
Google requires device manufacturers to complete compatibility and security assessments before their products receive certification.
However, the company said Videostrong concealed malicious code to bypass a gap in these testing procedures and introduced the backdoor after the device’s initial boot.
Google has since modified its review process and is strengthening firmware inspections for certified Android TV products.
As of November 2, Videostrong’s official website continued listing products advertised as Google Certified Android TV Boxes and Google Certified Android TV Sticks.
Plume’s investigation found that the botnet included both Google-certified devices and products running the Android Open Source Project (AOSP) version of Android.
However, Google did not disclose how many certified Android devices were affected by the campaign.
The incident also highlights the difference between Google’s previous BadBox 2.0 investigation and the latest operation.
When Google filed a lawsuit against the BadBox 2.0 botnet in July 2025, the campaign involved more than 10 million devices that were not certified by Google.
The latest findings raise additional questions about how malicious firmware can bypass security checks and reach consumers through devices marketed as certified Android products.
Conclusion
The takedown of the 1.3 million-device Android botnet represents a significant disruption to a large-scale cybercriminal infrastructure.
However, the incident highlights a serious security problem involving compromised firmware and preinstalled backdoors in consumer electronics.
Unlike conventional malware that users may be able to remove by uninstalling an application, firmware-level threats such as x.cpe can survive ordinary cleanup attempts and remain embedded in the device.
The investigation also demonstrates how compromised smart TVs and other inexpensive Android devices can be converted into residential proxy networks, advertising fraud platforms, and tools for unauthorized surveillance.
For consumers, purchasing devices from trustworthy manufacturers and checking their security support history is increasingly important. For businesses, network segmentation, device monitoring, and strict access controls remain essential to preventing compromised IoT devices from exposing sensitive systems.
