GOOGLE DISMANTLES X.CPE BOTNET HIDDEN IN MORE THAN 1.3 MILLION ANDROID-BASED DEVICES WORLDWIDE

Google and several cybersecurity companies, working with Japanese law enforcement, have disrupted the X.CPE botnet, a global malware operation embedded in more than 1.3 million devices across more than 200 countries.

Google attributed the operation to Videostrong Technology Co., Ltd., a Chinese Android original equipment and device manufacturer that produced set-top boxes and other connected devices. The overwhelming majority of infected systems were Android TV set-top boxes, although researchers also identified compromised telehealth devices, karaoke machines, digital signage systems, and other Android-based Internet of Things equipment.

The X.CPE backdoor was embedded directly into device firmware before the products reached customers. Researchers documented additional persistence mechanisms, including system-level installation, automatic reinstallation of removed components, and techniques intended to preserve device identification across firmware updates and factory resets. These mechanisms made unauthorized software difficult to eliminate through ordinary removal procedures.

Investigators said Videostrong monetized access to compromised devices by allowing criminal affiliates to load additional malware modules. Those modules were used for residential proxy services, advertising fraud, data theft, bandwidth resale, additional malware installation, and other unauthorized activity.

The residential proxy functionality allowed third parties to route internet traffic through infected devices using the victim’s internet connection, public IP address, and bandwidth. That activity could make malicious traffic appear to originate from legitimate residential networks rather than infrastructure controlled directly by cybercriminals.

Google said X.CPE evolved from relatively simple malware into a modular multi-stage architecture capable of supporting multiple monetization operations simultaneously. The backdoor could silently download and execute additional files without user authorization and maintain persistence even after attempted removal.

Researchers found that the malware could receive remote commands, install applications silently, execute shell commands, capture screenshots, perform network reconnaissance, and exfiltrate information from infected devices. In some configurations, the malware also attempted to disable Google Play Protect verification to allow additional payloads to be installed.

Google said it worked with Japan’s National Police Agency, along with cybersecurity companies including HUMAN Security, Plume, Synthient, TrendAI, and other research partners, to analyze and dismantle the infrastructure supporting X.CPE.

The disruption included legal action against domains and servers used to control the botnet and distribute malware. Google also targeted command-and-control infrastructure associated with more than a dozen additional malware families that had been installed through the X.CPE backdoor.

Google estimates that disrupting those affiliated command-and-control systems may have severed criminal access to an additional 10 million compromised devices, including systems outside the Android ecosystem.

Following the investigation, Google terminated its relationship with Videostrong and banned the company, along with future subsidiaries and affiliates, from producing certified Android devices or supplying software to manufacturers participating in Google’s certified Android ecosystem.

Google also said it has modified its device-review procedures after investigators determined that Videostrong used obfuscation techniques to bypass existing security testing and activate malicious code after devices completed their initial boot process.

The company said the campaign did not appear to be an accidental software flaw or the work of a single unauthorized employee. Investigators assessed that the backdoor and supporting infrastructure were intentionally developed and maintained as part of a long-term system for generating revenue from compromised devices.

Although the takedown cut communication between infected devices and major portions of the botnet’s command infrastructure, devices containing the preinstalled malware may still retain the underlying malicious software in their firmware. Google said its disruption rendered the severed infrastructure ineffective, but the investigation illustrates the continuing risks posed by compromised consumer electronics that arrive with malicious software already installed.

The X.CPE operation demonstrates how inexpensive connected devices can be transformed into persistent cybercrime infrastructure without the owner ever knowingly installing malware. Once connected to a home or business network, a compromised device can provide attackers with bandwidth, network presence, processing capability, and a residential IP address that can be exploited long after the original purchase.

Plume Security Labs, The X.CPE Botnet: From Device Management to Monetization Framework, October 2026. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE