Google and Partners Disrupt 1.3 Million-Device XCPE Botnet Allegedly Operated by Videostrong

On November 4, 2026, Google and partners announced the disruption of a large-scale botnet designated XCPE. According to reports, the botnet infected more than 1.3 million devices worldwide, primarily set-top boxes and Internet of Things (IoT) devices. Google alleges that Videostrong, an Android device manufacturer, ran the operation by distributing a backdoor malware payload through device firmware or associated software. This backdoor was purportedly used to conscript the devices into a criminal infrastructure network. The takedown operation targeted the botnet's infrastructure, though specific technical details regarding the method of disruption were not disclosed in the initial reports. Videostrong has issued a statement denying any involvement in running a botnet, asserting that its devices are secure and compliant with industry standards. The full extent of the criminal activity facilitated by the botnet, and the specific role of any partners in the takedown, remain under investigation. Security researchers advise owners of affected Videostrong devices to check for firmware updates and apply recommended security patches.