Japan’s National Police Agency teamed with companies including Google and Lumen to neutralize the XCPE backdoor malware network. Investigators determined that Shenzhen-based manufacturer Videostrong Technology intentionally embedded the malicious backdoor into products such as home TV boxes and projectors before selling access to criminal affiliates. TrendAI observed over 3.8 million distinct IP addresses connected to the malicious network between June 3 and October 1. In response, Google banned the hardware maker from preloading its applications, while the takedown successfully blocked criminal control over at least 10 million additional infected devices.
Key points
Hardware supply-chain tampering allowed attackers to disguise malicious network traffic a…: Hardware supply-chain tampering allowed attackers to disguise malicious network traffic and secretly manage unauthorized device applications.
Google has severed all commercial ties with Videostrong and banned the firm from preloadi…: Google has severed all commercial ties with Videostrong and banned the firm from preloading any Google software on its hardware.
The dismantled operation shares its underlying ecosystem with BadBox 2.0, a botnet that i…: The dismantled operation shares its underlying ecosystem with BadBox 2.0, a botnet that impacted over 10 million devices before its March 2025 shutdown.
Sources checked by our analysis pipeline: 1
- cross-posted to:
- privacy
- technology@lemmygrad.ml
- cross-posted to:
- privacy
- technology@lemmygrad.ml
A coalition of private-sector security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries.
Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption.
“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the Google Threat Intelligence Group (GTIG) said in a Monday blog.
Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers’ internet connections without their knowledge.
Boston's SoWa Power Station will host entrepreneurs and venture capitalists on November 4, 2026, for a comprehensive gathering centered on startup creation and long-term scaling. Attendees will gain access to direct peer networking, live pitching sessions, and dual-track tactical advice from leading investment firms. The gathering aims to equip emerging businesses with practical operational frameworks to navigate critical growth phases from seed rounds to enterprise scale.
Coordinated cyber incidents targeting internet-connected commercial cooling systems have triggered widespread inventory losses and physical damage across multiple countries. The campaign points to an intentional effort to destabilize critical food supplies, with operations spreading from European retail chains to American defense facilities. Investigators are now focused on securing poorly protected infrastructure exposed directly to the public web.
Hardware upgrades introduce notable durability improvements alongside substantial internal processing power for the compact tablet lineup. However, the premium pricing structure presents a challenging proposition given the continued omission of standard display and biometric features. Buyers must carefully evaluate these persistent compromises against the device's enhanced performance capabilities.