# Cops Bust Botnet of 1.3 Million Android TV Boxes DevFeed: [Cops Bust Botnet of 1.3 Million Android TV Boxes]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-11-03T11:00:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [IoT botnets](), [Android Security](), [MQTT](), [residential proxy network]() Tags: [affiliates](), [agent](), [android](), [android-tv](), [backdoor](), [botnet](), [c2](), [china](), [coalition](), [command](), [command-and-control](), [control](), [criminal](), [customers](), [device](), [devices](), [disrupted](), [embedded](), [financial](), [tv]() ## AI overview A coalition working with Japan's National Police Agency disrupted a botnet of more than 1.3 million Android devices across over 200 countries. Google assessed with high confidence that Videostrong Technology embedded the XCPE backdoor in device firmware and sold affiliates access to install malware modules. A preinstalled management agent connected to an MQTT server, enabling remote app installation and removal, settings changes, and updates; infected devices could also relay traffic through customers' internet connections without their knowledge. TrendAI recorded more than 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1. The coalition disrupted command-and-control domains, which Google said could cut affiliates' access to at least 10 million additional compromised devices. Google also ended ties with Videostrong and barred it from making devices with preloaded Google apps. ## Source excerpt A coalition of security firms working with Japan's National Police Agency has disrupted a botnet of more than 1.3 million Android devices across 200+ countries. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology," the Google Threat Intelligence Group (GTIG) said in a blog post. The Register reports: Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge. The firmware's pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. The coalition also disrupted the command-and-control domains used to manage the affiliate modules. "Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices," according to GTIG. Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps. Read more of this