Google Just Severed a Massive Botnet Infecting 1.3 Million Smart TVs

Imagine buying a smart device for your TV, plugging it in, and unknowingly turning it into a weapon for cybercriminals. That is the chilling reality uncovered by the Google Threat Intelligence Group, which recently led a massive international operation to dismantle the XCPE botnet.

Spanning more than 1.3 million active devices across over 170 countries, this sprawling criminal network was built directly into hardware before it ever left the factory floor.

According to Google’s in-depth technical findings, the malicious ecosystem was not the result of a rogue hacker hacking into cloud servers or a casual software vulnerability. Instead, investigators concluded with high confidence that an original equipment manufacturer named Videostrong Technology deliberately engineered, built, and operated the backdoor for financial gain.

The operation relied on a deeply embedded backdoor cleverly hidden inside the system partitions of various Android-powered electronics. While the vast majority of the compromised hardware consisted of budget Android TV streaming set-top boxes, the infection also spread to other unexpected gadgets.

Once a device was plugged into a home or office network, the pre-installed malware kicked into gear through a sophisticated, multi-stage architecture. Without the owners ever realizing it, their living room electronics were being used to route malicious traffic, load fraudulent web pages in hidden background windows, and mimic human clicks to generate ad revenue for bad actors.

Recognizing the scale of the threat, Google did not act alone. The company teamed up with international heavyweights, including Japan’s National Police Agency, Lumen Technologies, Human Security, Plume, Synthient, and TrendAI, to disrupt the command-and-control infrastructure.

Aside from severing the malicious servers, Google took direct punitive action against the hardware manufacturer. Videostrong has been officially banned from producing or supplying software for certified Android devices moving forward.

Investigators noted that this swift intervention severely disrupted over a dozen distinct cybercriminal groups who relied on the infrastructure.