Ethical Hacking News
A major botnet operation involving 1.3 million infected Android TV boxes has been disrupted by a coalition of security firms and law enforcement. The botnet, which was embedded with a malicious backdoor, was used for financial gain, highlighting the ongoing threat of cybercrime in the IoT sector.
A coalition of private-security firms and Japan's National Police Agency disrupted a massive botnet comprising over 1.3 million infected Android TV boxes. The operation targeted a backdoor embedded in device firmware by Videostrong Technology, a Chinese hardware manufacturer. The backdoor allowed remote control of infected devices, installation and removal of apps, and pushing of updates. The disruption documented over 3.8 million distinct IP addresses connected to the operation. The incident highlights the ongoing threat of cybercrime, particularly in IoT devices. Google cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps. The incident emphasizes the need for robust security measures in IoT devices and continued vigilance against emerging cyber threats.
A recent collaboration between a coalition of private-sector security firms and Japan's National Police Agency has resulted in the disruption of a massive botnet comprising over 1.3 million infected Android TV boxes, spanning more than 200 countries. The operation, which was carried out by Google, Lumen, Human Security, Plume, Synthient, and TrendAI, targeted a backdoor embedded in device firmware by Videostrong Technology, a hardware manufacturer based in Shenzhen, China.
Videostrong, which specializes in building Android devices, including home TV boxes and projectors, had deliberately incorporated the XCPE backdoor into device firmware. This backdoor allowed operators to remotely control infected devices, install and remove apps, change settings, and push updates to the devices without the knowledge of the customers. The preinstalled management agent, which pulled updates from a GitHub page, connected to a Message Queuing Telemetry Transport (MQTT) server that provided full remote control of each box.
The coalition, which also disrupted the command-and-control domains used to manage the affiliate modules, documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. The disruption of the command-and-control domains is expected to sever access to at least 10 million additional compromised devices, as the affiliates have diversified distribution channels for their modules beyond XCPE.
The operation is part of the same ecosystem as BadBox 2.0, another notorious botnet that infected more than 10 million TV boxes and other devices before being disrupted in March 2025. The incident highlights the ongoing threat of cybercrime, particularly in the realm of IoT devices, which are increasingly being targeted by malicious actors.
Google has since cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps. Videostrong did not immediately respond to inquiries from The Register.
The incident serves as a reminder of the importance of robust security measures in IoT devices and the need for continued vigilance in the face of emerging cyber threats. As the number of connected devices continues to grow, so too does the potential for malicious actors to exploit vulnerabilities and compromise user safety.
Related Information:
https://www.ethicalhackingnews.com/articles/Cops-Bust-Botnet-of-13-Million-Infected-Android-TV-Boxes-Exposing-Malicious-Backdoor-and-Cybercrime-Operation-ehn.shtml
https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045
Published: Mon Nov 2 13:58:49 2026 by llama3.2 3B Q4_K_M
