Google: TV Box Maker Sold 1.3M Devices to Criminals

More than 1.3 million Android devices — most of them set-top boxes sitting under televisions in over 200 countries — spent months working for someone other than their owners. In late October, a Google-led coalition used legal action to seize the domains and servers running the botnet, cutting off its operators. Google, Lumen, Human Security, Plume, Synthient and TrendAI took part, alongside Japan's National Police Agency, according to The Register.

The takedown is the easy part of the story. The expensive part is Google's central claim: this was not a supply-chain compromise in the usual sense, where a bad actor slips something into a vendor's build pipeline. Google says the vendor was the bad actor. Its Threat Intelligence Group assesses with high confidence that Shenzhen-based manufacturer Videostrong Technology built the backdoor, called x.cpe, into its own firmware on purpose — and then sold access to criminal affiliates. Videostrong did not respond to The Register's inquiries, so treat that as an allegation Google is standing behind, not a courtroom finding. But if it holds, the question for every buyer and reseller of cheap Android hardware changes entirely. It's no longer a question of whether the box is a risk. It's a question of what exactly the buyer thought that rock-bottom price was saving them.

The backdoor was a feature, not a bug

Here's what makes this different from the usual botnet story. The x.cpe backdoor runs as a system app inside the device firmware, with system-level privileges, signed with the manufacturer's own key. It wasn't installed by a phishing email or a drive-by download. It left the factory installed, The Hacker News reported, built into many device models and brands over several years. Google explicitly says it does not believe a rogue insider or a mistake was responsible.

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology," the Google Threat Intelligence Group said.

The mechanics, per TrendAI's analysis: the firmware's pre-installed management agent posed as a standard remote-management client. It pulled updates from a GitHub page and reported to an MQTT server that handed the operator full remote control of each box — install and remove apps, change settings, push updates. When it needed to install software silently, x.cpe first switched off the app-verification checks in Google Play Protect, Android's built-in security layer. That's a neat trick, and not a cheap one to build. This was productised.

What could the operators do with that access? According to Google's analysis, quite a lot: install apps without the owner knowing, run arbitrary commands, capture the screen, and map the network the box sits on. Google says it observed Videostrong's operators actually using these powers — taking live screenshots, injecting keystrokes, copying out account details, app lists and system logs, and opening reverse shells into the boxes. Remember, these devices weren't all in living rooms. The backdoor also turned up on telehealth devices, karaoke machines and digital signage. A reverse shell into a telehealth device is a sentence I did not enjoy typing.

What 1.3 million boxes are worth to a criminal

Follow the money, because that's the entire business model. Most of the add-on modules loaded through the backdoor did one of two things: turned the boxes into residential proxies or sold their spare bandwidth. A residential proxy lets a paying customer route traffic through an ordinary household's internet connection, so whatever they're doing looks like it comes from someone's sofa rather than a datacenter. Other modules ran ad fraud, faking views of online ads. The box owner gets nothing except a slightly warmer device and an IP address that now shows up in someone else's incident report.

The scale numbers deserve a slow read. Between June 3 and October 1, TrendAI counted 1,472,554 infected devices across 206 models — and says the real figure is at least that high. Over the same window it logged more than 3.8 million distinct home and mobile IP addresses connecting into the operation. Malaysia, Brazil, Iraq, Mexico and Taiwan topped the infection table; the US, Germany, the UK, Australia and Canada each carried roughly 26,000 to 42,000 infected devices. This was a global inventory of other people's bandwidth, rented out by the hour.

The coalition didn't stop at the backdoor's own infrastructure. It also took down the command-and-control domains of more than a dozen malware families that were being loaded through x.cpe by the criminal affiliates who bought access. Because those affiliates distribute their modules through other channels too, Google estimates the wider action severs their access to at least 10 million additional compromised devices. Google also cut ties with Videostrong entirely, banning the company — and any future subsidiaries or affiliates — from building or selling certified Android devices and from supplying software to other certified makers. That's the closest thing the Android ecosystem has to a corporate death penalty.

One caution before anyone declares victory: Google itself warns that backdoor operators and their customers switch tools quickly when one part of the setup is disrupted. And this ecosystem has form. The whole operation sits in the same world as BadBox 2.0, the botnet that infected more than 10 million TV boxes and other devices before Human, Google and TrendAI disrupted it in March 2025. Knock down one cash register, the shop reopens under a new name. Which brings us to the part buyers don't want to hear.

You can't patch your way out of this one

Every CISO's first instinct is remediation. Wipe it, patch it, move on. Doesn't work here. Because x.cpe lives in the firmware as a system app signed with the manufacturer's key, removing it doesn't stick — it reinstalls itself when the box restarts. The owner cannot fix the device. TrendAI's verdict on cleanup is blunt: it requires "vendor action, platform protection or replacement of the device." Given that the vendor is the accused party, vendor action seems optimistic.

Plume recommends a full factory reset on the grounds that the criminal modules may have installed additional backdoors of their own — though it notably does not claim a reset removes x.cpe itself. Synthient, which tracks proxy networks, skips the nuance entirely: it tells consumers to throw the boxes away for good. When the threat-intel firm's remediation advice amounts to binning the hardware, that's your answer on whether this hardware passes a cost-benefit test. Synthient bought a MECOOL KM9PRO Max — MECOOL being the consumer brand it links to Videostrong — and found the backdoor preinstalled out of the box. Plume found more than a dozen devices talking to the botnet's control server, most of them MECOOL. Synthient has published a list of 182 model names seen in the campaign, with the honest caveat that a model name alone doesn't confirm infection.

The due-diligence maths nobody ran

Now the uncomfortable arithmetic. Nobody pays for a security audit on a gadget that costs less than a team lunch. That's rational right up until it isn't. The due diligence that would have caught this isn't exotic: buy Google-certified devices rather than no-name Android builds (Google's ban on Videostrong only bites certified hardware — that's the whole point of certification), demand some evidence of firmware provenance from the OEM, and put anything smart-but-unmanaged on a network segment where it can't see anything that matters. None of that requires a new platform purchase. It requires a procurement policy with teeth and an hour of network configuration. We've seen the same lesson land in software supply chains — the LiteLLM backdoor planted with stolen GitHub tokens was different in method but identical in moral: the trusted thing you didn't verify is the thing that hurts you.

For enterprises, the exposure is mostly indirect but real. TrendAI advises companies with remote staff to treat unmanaged consumer devices on home networks as part of their attack surface, and to keep corporate access behind managed devices. If your hybrid workforce is VPN-ing in from home networks where a backdoored TV box is quietly selling the household's bandwidth and mapping the LAN, your trusted residential IP space isn't. Synthient's organisational advice is equally concrete:

• Use its published indicators to hunt for MECOOL or similar devices on your network.
• Disconnect and dispose of any that turn up.
• Block the listed control domains and IP addresses at the resolver and the perimeter.
• Keep smart devices on separate segments, away from sensitive systems.

Resellers and channel partners should sit up straight too. If you stocked or recommended these boxes, you now have customers running hardware the vendor allegedly pre-sold to criminals, with no fix short of disposal. The support calls, the replacements, the quiet erosion of trust — that's all margin you already spent. The cheap unit price was a loan, and the interest just came due.

The call

Let's keep perspective: for most enterprises this is not a five-alarm fire. The botnet monetised consumer bandwidth and ad impressions, not corporate crown jewels, and the takedown has already cut the operators' legs off. If your exposure is a few streaming boxes in the office kitchen, your remediation budget is a bin bag. But as a procurement lesson, this one's cheap at twice the price. Google is alleging that a manufacturer monetised its own customers twice — once at the till, once on the criminal market — and the only defences that worked were the boring ones: certification, provenance, segmentation, and managed access for remote staff. Audit what Android-based hardware you own or resell this quarter, segment what you can't verify, and stop letting unit price be the only number in the spreadsheet. The cheapest box on the shelf just demonstrated its true cost. It's whatever a slice of a 1.3-million-device botnet rents for.