Google-Led Takedown Halts Major IoT Botnet Operation
Google, in collaboration with industry partners, has announced the successful dismantling of a sophisticated botnet dubbed “XCPE.” This operation compromised over 1.3 million Android TV set-top boxes by turning them into illicit residential proxy servers, used for various criminal activities including advertising fraud and account takeovers. Experts estimate the takedown will sever access to an additional 10 million compromised systems, encompassing a wide range of Internet of Things (IoT) products beyond TV boxes, such as Android-based healthcare devices and karaoke machines.
The Google Threat Intelligence Group (GTIG) identified Videostrong Technology Co., a China-based TV box manufacturer, as the entity responsible for pre-installing the malicious software. This intentional act represents a significant breach of trust and a severe supply chain security risk for users, as infected devices were offered as a distribution mechanism for various criminal actors without user knowledge or consent, according to KrebsOnSecurity.
Understanding the XCPE Botnet’s Modus Operandi
The XCPE botnet, named after a core code component of its malware, loaded devices with software that made their internet addresses available for resale through multiple “residential proxy” services. These services enable customers to rent legitimate internet addresses, primarily to anonymize web traffic or spoof their geographical location. While seemingly benign, such services are frequently exploited for malicious purposes, facilitating widespread unwanted traffic, including credential stuffing, large-scale content scraping for AI projects, and advertising fraud.
GTIG’s investigation revealed that Videostrong monetized this backdoor by selling access to criminal affiliates who then loaded their own malware modules onto the infected devices. Google has initiated legal action to seize the domains and servers used by Videostrong to control the botnet and distribute additional malicious payloads. While Android TV boxes constituted the majority of the compromised devices, the XCPE malware was also discovered in other Android-based IoT products, such as telehealth devices, karaoke machines, and digital signage systems, underscoring the broad implications of this hardware-level compromise.
Google stated that it mandates all Android device manufacturers to pass compatibility and security tests. However, Videostrong found a method to install its malicious software immediately after a device’s initial boot-up. Google has since addressed this specific vulnerability, aiming to prevent similar compromises.
Videostrong Technology Backdoor Implications and Ecosystem Impact
Several residential proxy providers were implicated in the GTIG report, as their Software Development Kits (SDKs) were routinely downloaded by XCPE-infected devices. These include AppSalt (also known as Honeygain), owned by Oxylabs (now rebranded as Source), and NetNut, previously operated by Alarum Technologies. The FBI, in July 2026, worked with industry partners to seize domains associated with NetNut for its alleged role in operating a separate botnet, Popa, which also enslaved TV boxes as residential proxies. Other proxy services named were EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. Synthient, a startup that tracks proxy providers, also contributed research, noting that Videostrong’s malware distributed software for the proxy service Grass, a service previously linked to other Android TV devices.
Mitigating Android IoT Proxy Malware and Recommendations
Given the pervasive nature of such threats, mitigating Android IoT proxy malware requires a multi-faceted approach for both individual users and organizations. The intentional pre-installation of malware by a device manufacturer highlights the critical need for supply chain vigilance.
For Consumers:
- Source Devices Carefully: Purchase Android-based IoT devices, including TV boxes, only from reputable vendors and official channels. Avoid generic or unbranded devices from unofficial marketplaces, as these are often targets for pre-infection.
- Monitor Network Activity: Be vigilant for unusual network behavior, such as unexplained high bandwidth usage or connections to unknown external IP addresses, which could indicate detecting XCPE botnet activity or similar compromises.
- Stay Updated: Ensure all smart devices receive and apply security updates promptly. Though in this case the malware was pre-installed, future updates from legitimate manufacturers can address new vulnerabilities.
For Organizations:
- Strict Procurement Policies: Implement rigorous vetting processes for all IoT devices integrated into organizational networks. This includes verifying manufacturer reputation and confirming adherence to security best practices.
- Network Segmentation: Isolate IoT devices on dedicated network segments to limit their ability to interact with critical systems or exfiltrate sensitive data if compromised.
- Outbound Traffic Monitoring: Deploy network monitoring tools to detect and block suspicious outbound connections, especially to known residential proxy infrastructure or command-and-control servers.
- Regular Audits: Conduct regular security audits of all IoT deployments to identify and remediate vulnerabilities, including potential pre-installed malware.
Related: XCPE Botnet Dismantled: Android OEM Videostrong Implicated, Aftermarket Android Head Units: Bloatware & Privacy Risks