XCPE botnet dismantled after infecting 1.3 million set-top boxes

# XCPE botnet dismantled after infecting 1.3 million set-top boxes

https://gcdradar.vercel.app/incidents/xcpe-botnet-dismantled-after-infecting-1-3-million-set-top-b · AIR-2026-1705 · live

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss): Confirmed large-scale botnet affecting 1.3 million devices.
- Fix status: No fix needed
- First reported: 2026-11-02 (happened 2026-10-25)
- AI role: No AI role
- Products: XCPE backdoor, Android set-top boxes

## Summary

Google and industry partners dismantled the XCPE backdoor which infected over 1.3 million set-top boxes. The OEM Videostrong Technology operated the botnet for financial gain by loading ad-fraud modules.

## What to do

Disconnect or replace affected compromised set-top boxes.

## Affected and fixed versions

- Affected: Videostrong Android set-top boxes

## Latest updates

- 2026-11-03: Takedown actions severed botnet access to more than 10 million additional compromised IoT systems (https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies)
- 2026-11-02: Shutting the Door on the XCPE Botnet (https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet)

## Sources

- 2026-11-02 Google Threat Intelligence: Shutting the Door on the XCPE Botnet https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet
- 2026-11-03 Krebs on Security: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.