Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.47 million infected Android devices globally across 206 models, with about 88,000 devices in Taiwan—ranking 5th worldwide [1]. Because the backdoor is preloaded directly into device firmware, users cannot easily remove it via system updates or app uninstallation; infected devices are used as persistent proxy nodes and for ad fraud [1]. Organizations and users are advised to disable or replace Android set-top boxes from unknown sources [1].
MediumActiveResearcher reported
XCPE Botnet: Android Set-Top Boxes Shipped with Preloaded Backdoor; ~88,000 Devices Infected in Taiwan, 5th Globally
1 min read
- Disclosed
- Nov 4, 2026
- Published
- Nov 7, 2026
- Last updated
- Nov 6, 2026
- Scale
- 1,470,000 devices[1]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Actor type
- Motivation
- MITRE ATT&CK
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Cross-industry
What to do nowOur advice
Android set-top boxes from unknown sources should be disabled or replaced [1].
Timeline
- TrendAI publishes regional infection scale[1]
Technical details
What Happened
On November 3, the Google Threat Intelligence Group announced legal and technical disruption measures against XCPE: the backdoor was preloaded into firmware by manufacturer Videostrong and automatically reinstalls from the /oem/ partition upon reboot if removed; Google has taken down its C2 domains and barred the company from producing certified Android devices [2]. According to iThome, XCPE stands out because the equipment supplier embedded the backdoor into firmware prior to factory shipment, leaving devices compromised upon delivery; during its observation period, TrendAI recorded over 3.84 million IP addresses linked to the infrastructure, indicating large-scale abuse of the devices as proxy network nodes [1].
Impact in Taiwan
Malaysia accounted for the highest number of infected devices at 300,000, followed by Brazil (150,000) and Iraq (120,000), with Taiwan ranking 5th at 88,000 devices; affected hardware primarily consists of Android TV set-top boxes as well as projectors [1].
Our analysis
The following is our opinion, not a sourced statement.
Allowing inexpensive employee-brought or conference-room set-top boxes onto a corporate network effectively places an externally controllable proxy node inside the internal network. Organizations should isolate such devices on guest network segments and monitor for abnormal persistent outbound connections.
Remediation
Vendor guidance
- 1Inventory Android set-top boxes and projectors from unknown sources detect[1]
Record device models and firmware versions to check whether the supplier is on the affected list.
Our addition
- 1Isolate or replace affected devices mitigate[1]
Because the backdoor is preloaded in firmware, a factory reset cannot remove it; enterprise environments are advised to replace these devices outright and place any similar hardware on an isolated network segment.
References
Research1
- [2]
“it automatically reinstalls from the /oem/ partition upon reboot”
Media1
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.