Michael JohnsonOwners of Android TV set-top boxes running firmware from Videostrong should check where their devices came from: on November 2, Google said it and its partners had disrupted the XCPE botnet, which included more than 1.3 million set-top boxes. As part of the operation, Google sought to disable command servers and malicious domains, and Videostrong was barred from producing certified Android devices with preinstalled Google apps. Google described the operation as a response to a backdoor embedded in the firmware of several models.
What was actually disrupted
According to the Google Threat Intelligence Group, XCPE used a component called x.cpe embedded in the firmware. It connected to a command server, received instructions, and downloaded additional modules. Google reported legal action against the domains and servers Videostrong used to operate the botnet and install malicious components, as well as against the command domains of more than a dozen malicious families.
Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI took part in the operation. Google also said it had barred Videostrong and its future subsidiaries and affiliates from manufacturing and selling certified Android devices and from supplying software to other certified manufacturers. The company reported changes to Android TV firmware integrity checks.
“Disrupted” is more accurate than promising to instantly clean every TV. Google describes dismantling the command infrastructure and related domains; its post does not report remotely fixing the firmware on every set-top box already sold. Disabling servers deprives operators of important channels for control and module delivery, but does not by itself rewrite installed software.
Why the infection survived a reboot
The malicious component was in the firmware’s system partition. Google writes that x.cpe ran with system privileges and could restore its copy after a reboot if a user deleted the app from the regular data partition. So trying to find and remove a suspicious app through Android settings was no guarantee that the set-top box had been cleaned.
The backdoor maintained a persistent connection to its command infrastructure and could receive instructions to install apps covertly, launch a shell, and collect data. Google said it had observed screen captures, command input, the transfer of account and system information, and the execution of scripts. Downloaded modules turned devices into nodes in residential proxy networks or used them for ad fraud; some modules installed additional malware.
This makes an ordinary TV set-top box part of someone else’s network infrastructure. Traffic routed through a home connection may look like the user’s own traffic, even though the device is actually carrying out commands from a remote operator. Google also identified fraudulent ad impressions and data transfers among the activities.
What set-top box owners should do
First, check the device’s exact brand and model, firmware manufacturer, and certification details. A brand name alone does not confirm an infection: Google says Videostrong software appeared on many models and brands, so the device’s origin and firmware are what matter. Check the details against the current list of official Android TV partners and the seller’s or manufacturer’s documentation.
If you cannot establish where the device came from, or it belongs to the affected ecosystem, disconnect it from the network and ask the seller or manufacturer for confirmed instructions on replacement or reflashing. A factory reset and app removal should not be treated as a sufficient fix for a component that, according to Google, is stored in the system firmware and returns after a reboot. Do not install random firmware images from forums: the wrong image could brick the device or introduce new risks.
If you used the set-top box to sign in to accounts or view personal information, check account activity from another trusted device and change passwords if you see signs of unauthorized access. This step protects your accounts; it does not clean the set-top box itself, so you need to address the device separately.
What remains after the operation
Google links XCPE to the deliberate installation and commercial use of Videostrong’s backdoor. The company also estimates that disabling the command domains used by related modules could cut off access to them for more than 10 million additional compromised devices outside XCPE. This is Google’s estimate of the potential impact of measures against shared infrastructure, not a confirmed count of cleaned devices.
The main practical takeaway for users is simple: if a set-top box came from an unknown source or runs Videostrong firmware, deleting apps and rebooting do not reliably confirm that it is clean. Checking the model and origin, then replacing the device or restoring its firmware through a verified process, is better supported than trying to manually remove one visible component.
