Google, working with law enforcement and security firms, has taken down a botnet that it says was built directly into the firmware of more than 1.3 million connected devices.
The company alleges that Videostrong Technology, an Android device manufacturer based in Shenzhen, planted a hidden backdoor in its products and sold access to criminal affiliates for profit. Google made the operation public on November 2, according to a report by Analytics Insight.
A Backdoor Hidden at the Factory Level
The malware, which Google calls XCPE, switched on after a device was powered up for the first time. Once active, it let operators install further tools without the owner ever knowing.
Google said Videostrong allegedly used code obfuscation to slip past certification checks, then loaded the malicious components during initial setup. The company characterized the scheme as a deliberate business operation rather than an accidental security flaw.
Global Reach Across Many Product Types
Google traced infections across multiple brands and models spanning several years, with compromised devices found in more than 200 countries.
The affected hardware was not limited to entertainment gear. Alongside Android TV set-top boxes, the list included telehealth equipment, karaoke machines and digital signage systems.
How Criminal Affiliates Exploited Infected Devices
Access to the backdoor gave affiliates a foothold inside household networks and the connected hardware on them, all without user consent.
Affiliates allegedly used the devices to generate fake advertising views and to route traffic through residential internet connections, a technique that helps disguise malicious activity as ordinary home use.
Google also found modules capable of installing more malware, capturing screens, logging keystrokes and stealing account credentials.
A Coordinated Takedown With Wider Impact
The disruption involved Japan's National Police Agency along with Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google pursued legal action against Videostrong's control servers and the domains used to push additional malware modules.
Google has also ended its relationship with Videostrong and barred the company's affiliates from manufacturing certified Android devices or supplying software for them.
The effort went beyond XCPE, targeting command domains linked to more than a dozen other malware families. Google estimates these steps could cut off access to at least 10 million additional compromised devices.
Why Infected Devices Remain a Problem
Shutting down command servers does not automatically clean devices already carrying the malware. According to Google's technical report, the backdoor sits in the system partition and can reinstall itself after removal, meaning a simple reboot may bring it back.
That leaves typical users without a dependable way to remove it themselves. Google has updated its device review process and is urging consumers to buy connected products from reputable manufacturers, apply firmware updates and disconnect suspicious devices from home networks. Devices that keep behaving abnormally may need to be replaced after checking with the manufacturer.
What the Case Signals for the Device Supply Chain
The case highlights a growing risk in the low-cost connected hardware market: threats introduced by the manufacturer itself, before a product ever reaches a buyer. Certification programs only help if they can detect deliberately hidden code.
For hardware startups and platform partners, the episode underscores the value of supply chain scrutiny and transparent firmware practices. For consumers and businesses deploying inexpensive smart devices, it is a reminder that the cheapest option can carry hidden costs.
Source: Analytics Insight
