Google reported that legal action in late October 2026 disrupted the command-and-control (C2) infrastructure for x.cpe, an Android botnet affecting more than 1.3 million devices, mostly TV set-top boxes. The operation targeted the systems used to send commands to infected devices. It did not itself remove the firmware backdoor from boxes already in homes. Google Threat Intelligence Group’s account of the operation describes the disruption and Google’s response.
What the disruption changed
Google assessed with high confidence that Videostrong Technology Co. intentionally developed, deployed and operated the backdoor and botnet for financial gain. Google’s reported response included legal action against control domains and servers, restrictions on Videostrong and future subsidiaries or affiliates supplying certified Android devices or software to certified vendors, and changes to firmware-integrity checks and review processes.
Those measures targeted the operation’s infrastructure and access to the certified Android ecosystem. The reported device count and the infrastructure action describe the scale of the botnet and the disruption, not the number of boxes cleaned afterward.
How many devices were involved
Google reported more than 1.3 million affected Android devices, most of them TV set-top boxes. TrendAI separately counted 1,472,554 devices across 206 models during a June 3–October 1 observation window, and described its figure as a minimum. Other reported device types included telehealth equipment, karaoke machines and digital signage.
How x.cpe reportedly worked
The backdoor, also called com.oemservice in some builds, was reportedly preinstalled in firmware and ran with system-level privileges. It could restore itself from the /oem/ partition after a reboot, so removing it like an ordinary app would not establish that the firmware was clean.
Reported uses included residential proxy traffic, ad fraud and loading additional malware. The backdoor could also install apps silently, run shell commands, capture screens and collect information such as keystrokes, account and device details, app inventories and system logs.
A technical analysis by NetmanageIT describes an initial HTTP configuration request carrying an AES-encrypted JSON object with device telemetry, followed by a persistent MQTT connection. In the C2 activity that analysis describes, module installation, removal and configuration were the most common interactions.
What device owners can tell from a model name
Synthient reportedly compiled a list of 182 model names associated with the campaign. A name on the list does not identify an individual infected unit. Synthient also reportedly found x.cpe preinstalled on a MECOOL KM9PRO Max it purchased; that finding applies to the purchased device.
Plume recommended a full reset to address the possibility of additional modules. The reported backdoor’s firmware placement and ability to return after reboot remain central to the cleanup question, while TrendAI described vendor action, platform protection or device replacement as remediation options.
