Follow us on Google News
An international coalition of cybersecurity companies, working alongside Japan’s National Police Agency, has dismantled a cybercrime network that infected more than 1.3 million Android devices across over 200 countries. The coordinated operation neutralized a dangerous firmware backdoor known as XCPE, which turned consumer hardware into an extensive illicit botnet. Shenzhen-based hardware manufacturer Videostrong Technology has been accused of intentionally planting the malicious code into the firmware of its home TV boxes and projectors before shipping them to unsuspecting buyers. Google’s Threat Intelligence Group assessed with high confidence that the company deliberately developed, deployed, and operated the backdoor for financial gain.
Coordinated Global Action Against Firmware Botnet
The cross-border enforcement operation brought together major cybersecurity entities including Google, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. These organizations coordinated efforts to identify compromised equipment, sever communication links, and block access to control servers operated by the criminal syndicate. The primary focus of the operation was the XCPE backdoor, a hidden utility engineered to grant remote access and complete administrative control over consumer devices without the knowledge or consent of users.
Investigators found that Videostrong manufactured Android-based consumer electronics, including television boxes and projectors, with the backdoor pre-installed inside factory firmware. When customers connected these systems to their local residential networks, the hidden component activated, converting ordinary household hardware into illicit proxy routing points. Criminals subsequently funneled their own unauthorized online traffic through these residential connections, using legitimate customer networks to obscure their geographic locations and cloak ongoing cybercrime operations.
Technical Infrastructure and Remote Command Architecture
An investigation conducted by TrendAI established that the altered firmware carried an embedded management agent designed to look like a standard remote-management tool. The component maintained extensive remote-execution capabilities by retrieving instructions from a GitHub repository and establishing connections to a Message Queuing Telemetry Transport server. Through this mechanism, external operators could alter system settings, deploy or delete software, and silently push updates directly onto infected household units.
During their surveillance between June 3 and October 1, researchers at TrendAI identified more than 3.8 million distinct residential and mobile IP addresses linked to the malicious enterprise. Analysts noted that while the high IP count demonstrated the vast scope of network traffic passing through the infrastructure, it reflected dynamic address assignments across consumer internet connections rather than the direct volume of infected hardware units.
Disruption Impact and Broader Industry Ties
As part of the coordinated enforcement drive, coalition partners brought down central command-and-control domains that were also used to administer external malicious payloads distributed via criminal affiliate schemes. Google reported that severing these core communication domains could eliminate threat-actor access to at least 10 million additional compromised devices infected through channels outside XCPE, multiplying the reach of the disruption far beyond the initial 1.3 million devices.
Following the findings, Google severed all commercial ties with Videostrong and prohibited the Shenzhen hardware maker from manufacturing devices featuring preloaded Google services. Videostrong did not immediately reply to inquiries concerning the allegations. Security analysts noted that the XCPE operation forms part of the broader BadBox 2.0 ecosystem, a sprawling botnet campaign disrupted in March 2025 by HUMAN Security, Google, and TrendAI after compromising more than 10 million connected systems. The case highlights continuing hardware security risks surrounding cheap consumer electronics, which can be weaponized at the factory level to turn residential networks into criminal infrastructure.
