Google says the operation also cut off access to at least 10 million additional compromised devices. It banned Videostrong and future affiliates from producing certified Android devices or supplying software to certified manufacturers.
A Google-led takedown in late October disrupted the servers controlling a botnet of more than 1.3 million Android devices, mostly TV set-top boxes. A botnet is a network of infected devices that operators control remotely.
TrendAI counted 1.47 million infected devices across 206 models between 3 June and 1 October, and says the real number is at least that high.
Google says related server takedowns also cut off access to at least 10 million additional compromised devices, BleepingComputer said. Those devices were infected through other malware-distribution routes, not through the XCPE backdoor behind the main botnet. Google says not all of them were Android devices. Cutting off remote access does not remove malware from the devices.
Google also ended its relationship with device maker Videostrong. It banned the company and future subsidiaries or affiliates from building or selling certified Android devices and supplying software to other certified-device manufacturers.
Videostrong, based in Shenzhen, China, makes Android TV boxes and other devices under its own name and for other brands. Google says it has high confidence that Videostrong deliberately installed the backdoor and sold access to criminals. It rejects a rogue employee or development mistake as the explanation.
Synthient bought a MECOOL KM9PRO Max and reported finding the backdoor preinstalled. Plume found more than a dozen different devices communicating with the botnet’s control server, mostly MECOOL devices, and said Videostrong supplies both their firmware and remote-management tools.
Google says it saw operators take screenshots, send keystrokes and extract account details and device information. Most criminal add-on programs turned the boxes into residential proxies: services that route customers' internet traffic through household connections so it appears to come from those homes. Other programs generated fake advertising views.
The decree aims to keep Russia’s IT infrastructure running by giving authorities access to reserved capacity through a government commission.
The backdoor, called x.cpe, is embedded in the firmware—the device’s built-in software. Owners cannot permanently remove it themselves because it reinstalls when the box restarts, The Hacker News said.
TrendAI, Trend Micro’s enterprise business unit, says the backdoor runs as a system application signed with the manufacturer’s key. Cleanup therefore requires vendor action, platform protection or replacement of the device.
Plume recommends a full factory reset because additional modules may have installed other backdoors; it does not say whether a reset removes x.cpe itself. Synthient advises consumers to discard affected boxes. For organizations, it recommends using its published indicators to identify suspect MECOOL or similar devices, disconnecting and discarding them, blocking the control domains and IP addresses listed in its report, and keeping smart devices on separate network segments away from sensitive systems.
2 min
Shadowserver reported more than 1,000 internet-exposed GitLab servers still unpatched against CVE-2026-97229, which CISA confirms is being actively exploited. GitLab urges self-managed operators to upgrade immediately.
2 min
Apple says the error appears only on the resting Always On display after daylight-saving changes. Waking the screen shows the correct hour, and owners can try changing the watch face or restarting.
1 min
Update ·
Google now says the takedown cut off access to at least 10 million additional compromised devices, rather than only expecting that result.
