[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRkd1BakXHtVF1iLPhMR6MeZq4sVmO_jw38A3ITwVNbM":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"f4dd49eb-cd01-4970-9b97-aa689b47196f","Google, Partners Disrupts 1.3 Million-Device-Strong XCPE Botnet","google-partners-disrupts-1-3-million-device-strong-xcpe-botnet-fd6556","Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity.","Google and partners have dismantled the XCPE botnet, which compromised approximately 1.3 million Android devices, set-top boxes, and IoT devices. The operation allegedly involved Videostrong, an Android device manufacturer, who deployed a backdoor to establish infrastructure for criminal activities. This coordinated disruption represents a major takedown of one of the largest botnets targeting consumer electronics.","Google disrupts XCPE botnet controlling 1.3M devices allegedly operated by Videostrong.","https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fgoogle-13-million-device-strong-xcpe-botnet","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt40a50320ed3d3a77\u002F6aeb310312acd3feff711f6e\u002Frogue_AO_bot_Chris_Light_Alamy.png?width=720&quality=80&disable=upscale","2026-11-04T16:24:08+00:00","2026-11-04T17:00:31.852586+00:00",8,[17,20,22,25],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Videostrong",{"name":23,"type":24},"XCPE Botnet","campaign",{"name":26,"type":27},"Android","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[45],{"type":32,"value":46,"context":47},"XCPE","Botnet malware targeting Android devices, set-top boxes, and IoT devices; 1.3M devices infected",[18,21],{"controls":50,"vendors":130},[51,80,101],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[85,93],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":102,"name":103,"problem":104,"products":105},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[131],{"slug":132,"name":18,"logo_path":133,"roles":134},"google","\u002Fvendor-logos\u002Fgoogle.png",[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":148},"manufacturer-backdoor-fuels-13m-device-xcpe-botnet","Manufacturer Backdoor Fuels 1.3M-Device XCPE Botnet","The XCPE botnet exploited a backdoor allegedly deployed by Android device manufacturer Videostrong, meaning the compromise was baked into devices before consumers ever powered them on. This is a textbook supply chain attack: end users had no practical way to detect or prevent the infection through normal security hygiene. The scale — 1.3 million devices spanning Android phones, set-top boxes, and IoT hardware — illustrates how a single compromised manufacturer can create an enormous criminal infrastructure with minimal ongoing effort. It matters because compromised devices were turned into botnet nodes used for criminal activity, putting both device owners and the broader internet ecosystem at risk.",[141,142,143,144,145,146,147],"CIS Control 15: Service Provider Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 13: Network Monitoring and Defense","NIS2 Article 21(2)(b)","MITRE ATT&CK T1195: Supply Chain Compromise",{"NIS2 Article 21(2)(b)":149,"NIST SP 800-53 SI-2: Flaw Remediation":150,"CIS Control 15: Service Provider Management":151,"MITRE ATT&CK T1195: Supply Chain Compromise":152,"CIS Control 13: Network Monitoring and Defense":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":155},"NIS2 requires organizations to manage supply chain security risks; the manufacturer embedding a backdoor represents exactly the kind of third-party risk that supply chain security policies under NIS2 are designed to prevent.","Firmware integrity checks and timely remediation processes would have flagged the unauthorized backdoor code embedded in the device supply chain before mass deployment.","Videostrong allegedly shipped devices with a pre-installed backdoor; rigorous vetting and contractual security requirements for hardware vendors and OEMs would have identified or prevented this supply chain compromise.","Videostrong allegedly pre-installed malicious backdoor code during the manufacturing process, which is a direct example of a supply chain compromise at the hardware\u002Ffirmware level that this ATT&CK technique documents.","Continuous monitoring of outbound network traffic from IoT and set-top devices would have revealed botnet command-and-control beaconing, enabling earlier detection of the 1.3 million compromised devices.","A formal process for identifying and managing technical vulnerabilities — including reviewing third-party firmware for malicious code — would have surfaced the backdoor present in these manufactured devices.","The backdoor established unauthorized remote access infrastructure; enforcing strict access controls and authenticated communication channels on IoT devices would have blocked or detected the backdoor's command-and-control communication."]