The X.CPE botnet was hidden inside more than 1.3 million internet-connected TV set-top boxes, according to Google, which says it and industry partners disrupted the operation last week. The company attributes the backdoor to device manufacturer Videostrong Technology with high confidence and says the malware was installed in firmware before devices reached customers. The case highlights a supply-chain risk: a streaming box can appear to work normally while quietly using a household’s internet connection for criminal activity.
How the X.CPE botnet reached consumer devices
Google’s Threat Intelligence Group says the malicious software was built into firmware used across multiple device models and brands over several years. The backdoor was designed to evade parts of the pre-release security process and load additional components after a device’s first boot. That approach meant buyers did not need to install a suspicious application or click a malicious link for the device to become part of the network.
Google says Videostrong monetized access by supplying criminal affiliates with malware modules. Those modules could turn compromised devices into residential proxy nodes, run advertising fraud and load further malware. Residential proxies route third-party traffic through ordinary home internet connections, making activity appear to originate from the subscriber’s network without the subscriber’s knowledge or consent.
What the X.CPE botnet takedown changed
Google says it took legal action to disrupt the domains and servers used to control the botnet and install modules, and also targeted command-and-control domains used by more than a dozen related malware families. The company says the disruption should sever access to at least 10 million additional compromised devices connected to those affiliate operations. That figure is Google’s assessment of the wider ecosystem affected by the control-domain action; it should not be read as a count of devices confirmed to be infected by X.CPE itself.
Google also says it has cut ties with Videostrong and barred the company and its future affiliates from making certified Android devices or supplying software to other certified vendors. It has changed its review process to better protect firmware integrity. Trend Micro and other partners contributed research and network intelligence, while Japan’s National Police Agency took part in the coordinated operation.
Why the X.CPE botnet raises a supply-chain warning
The incident shows why security checks cannot end when a device leaves a factory. Firmware, update mechanisms, third-party components and the behavior of a device after its first boot all matter. A consumer may have little visibility into what software is running at system level, particularly when the device is inexpensive, receives infrequent updates or comes from an unfamiliar brand.
Google’s account also describes a wider criminal market in which device access can be sold to different affiliates and reused for several kinds of abuse. Disrupting one command-and-control network can make operations harder, but Google cautions that affiliate groups may have other distribution channels. A takedown is therefore a significant interruption rather than proof that every related device or operator has been permanently removed.
What owners should know about the X.CPE botnet
Consumers should keep connected devices updated, avoid installing unofficial firmware and consider whether a streaming box comes from a manufacturer that provides security updates. Unusual network activity can be a reason to review a device’s settings or ask an internet provider for help, although ordinary users may not be able to identify a firmware backdoor from device behavior alone. The incident is also relevant to the wider patching problem covered in Kernel.news’ report on a Linux kernel flaw that enables remote root access.
The X.CPE operation is a reminder that connected-home security depends on manufacturers, platform providers, network operators and law enforcement. Google’s disruption removes important infrastructure, but lasting protection will require stronger firmware controls and continued monitoring of the affiliate networks that profit from compromised devices.
Sources: Google Threat Intelligence, November 2, 2026; Trend Micro and industry partners, November 2, 2026; BleepingComputer, November 2, 2026.
