[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN_j1VI95p5X1x1O8VmrFIFWNcJac1knSoo0EeliXOrk":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"c936fcb1-1d3f-490a-b123-9cd6dba6548d","Google disrupts XCPE botnet, bans the company behind it","google-disrupts-xcpe-botnet-bans-the-company-behind-it-667107","Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were enrolled. XCPE malware overview (Source: Google) Access The business model was access. Researchers say the company sold entry to its customers’ living rooms to criminal affiliates, who pushed their own … More → The post Google disrupts XCPE botnet, bans the company behind it appeared first on Help Net Security.","Google has dismantled the XCPE botnet, which infected over 1.3 million Android TV set-top boxes and other IoT devices by hiding malware in their firmware. The company attributes the operation to Videostrong Technology, the manufacturer of many of these devices, and has banned them from the Android ecosystem. The malware allowed affiliates to push modules for ad fraud, residential proxy services, credential theft, and further malware installation.","Google disrupts XCPE botnet, banning Videostrong Technology for malware on 1.3M+ Android TV devices.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F02\u002Fxcpe-botnet-android-backdoor\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F07\u002F31164042\u002Fandroid-malware.webp","2026-11-02T15:50:46+00:00","2026-11-02T16:00:21.339758+00:00",8,[17,20,22,25],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Videostrong Technology",{"name":23,"type":24},"Android TV","technology",{"name":26,"type":24},"IoT","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":31,"value":52,"context":53},"XCPE","Backdoor malware hidden in the firmware of Android TV set-top boxes.",[18,21],{"controls":56,"vendors":132},[57,86,111],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":87,"name":88,"problem":89,"products":90},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[91,98,103],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":93,"url":96,"description":97},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":99,"product_name":100,"url":101,"description":102},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[116,124],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[133],{"slug":134,"name":18,"logo_path":135,"roles":136},"google","\u002Fvendor-logos\u002Fgoogle.png",[137,138],"reported_by","affected",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"firmware-embedded-malware-in-android-tv-devices-exposes-supply-chain-risk","Firmware-Embedded Malware in Android TV Devices Exposes Supply Chain Risk","The XCPE botnet case reveals how a device manufacturer (Videostrong Technology) embedded malware directly into firmware before products ever reached consumers, making traditional endpoint defenses largely ineffective. Because the malicious code was present at the factory level, end users had no realistic opportunity to detect or remove it through normal means. This incident demonstrates that supply chain integrity — verifying the trustworthiness of hardware and software before deployment — is as critical as patching or perimeter defenses. With 1.3 million devices weaponized for ad fraud, credential theft, and proxy abuse, the downstream harm to businesses and individuals was substantial and largely invisible to victims.",[144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"CIS Control 17: Incident Response Management":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"NIS2 mandates supply chain security measures including the assessment of security practices of suppliers, which would have required scrutiny of Videostrong's firmware integrity before device adoption.","SI-2 requires organizations to identify, report, and correct information system flaws — including malicious firmware — which would mandate remediation or replacement of compromised IoT devices.","A mature incident response plan including IoT-specific playbooks would enable rapid isolation and replacement of compromised devices once the botnet activity was identified, limiting dwell time and damage.","Firmware containing embedded malware is a direct instance of a vulnerable component being introduced into the environment, exactly what A06 warns organizations to screen for during procurement and deployment.","Regular firmware vulnerability assessments and a process to evaluate manufacturer trustworthiness would have flagged Videostrong devices as high-risk before deployment.","This control requires timely identification and remediation of technical vulnerabilities, including those introduced through the supply chain via pre-installed malicious firmware.","Enforcing strict network access controls for IoT devices — preventing them from communicating freely with external infrastructure — would have limited the botnet's ability to exfiltrate credentials and relay proxy traffic."]