Google Dismantles 1.3 Million-Device Botnet: The Risks of Compromised Hardware Supply Chains

Google has announced the disruption of a massive malware operation involving more than 1.3 million Android devices, following an investigation that identified malicious software allegedly installed by the company responsible for manufacturing the equipment.

On November 2, 2026, Google Threat Intelligence Group confirmed that it had worked with international security partners to dismantle the XCPE botnet, which primarily affected Android TV set-top boxes.

According to Google's findings, Chinese manufacturer Videostrong Technology deliberately embedded malicious software into devices, enabling criminal groups to conduct advertising fraud, access information and route internet traffic through compromised equipment.

The case raises significant questions about technology supply chain integrity, manufacturer accountability and the limitations of relying exclusively on conventional Cyber Security testing.

For US businesses purchasing connected devices and network equipment, the findings highlight the importance of understanding security risks that may originate before products reach their intended users.

What Did Google Discover About the XCPE Botnet?

Google's investigation identified a large network of compromised Android devices operating across multiple countries.

The botnet, known as XCPE, had enrolled more than 1.3 million devices, most of which were Android TV set-top boxes.

Researchers also identified affected equipment used for digital signage, telehealth applications and other connected services.

The malicious software allowed operators to communicate with infected devices remotely and install additional programs without the owners' knowledge.

According to Google, the operation supported several activities, including:

• Advertising fraud carried out through compromised devices.
• Routing internet traffic through residential proxy networks.
• Installing additional malicious software.
• Collecting information from affected systems.
• Providing criminal affiliates with remote access to compromised equipment.

The investigation involved Google, Japan's National Police Agency, Lumen, HUMAN Security and several other Cyber Security organizations.

Google subsequently took legal action to disrupt the infrastructure supporting the botnet and its associated malicious software.

Why the Manufacturer's Alleged Involvement Matters

One of the most unusual aspects of the investigation is Google's conclusion that the malicious software was intentionally introduced by the device manufacturer.

The company stated that it had high confidence Videostrong Technology developed, deployed and operated the XCPE backdoor for financial gain.

According to Google, the malware was integrated into multiple device models over several years.

The manufacturer allegedly generated revenue by selling access to infected devices and allowing criminal affiliates to deploy additional malicious programs.

These findings distinguish the incident from conventional malware campaigns where attackers exploit vulnerabilities in devices that were originally supplied without malicious software.

Instead, Google alleges that the compromise originated within the manufacturing process itself.

Videostrong had participated in Google's certified Android device ecosystem. Following the investigation, Google terminated its relationship with the manufacturer and banned it from producing devices with preloaded Google applications.

The allegations concerning Videostrong are based on Google's technical investigation and attribution assessment.

How Did the Malware Avoid Security Testing?

Google requires manufacturers seeking Android certification to complete compatibility and security assessments.

However, its investigation found that Videostrong used techniques designed to conceal malicious functionality during testing.

The malware was configured to load additional malicious components after devices were first activated.

This allowed the affected equipment to pass existing security checks without the full malicious functionality being detected.

Once operational, the software could establish communication with external infrastructure and receive further instructions.

Google has acknowledged weaknesses in its previous testing arrangements and introduced additional measures intended to improve firmware integrity assessments.

The incident demonstrates an important limitation of point-in-time security testing.

A device may appear compliant when initially examined while containing functionality capable of activating later.

For organizations purchasing connected equipment, this creates a challenge that cannot always be resolved through ordinary configuration reviews or software updates.

The Business Risks of Compromised Connected Devices

Connected equipment has become a routine part of modern business operations.

Organizations increasingly use internet-connected displays, communications equipment, monitoring systems and other devices across offices, commercial premises and operational environments.

These products may be supplied by external manufacturers and installed with software that customers have limited ability to inspect.

Where a device contains hidden malicious functionality, it may create security exposure beyond the equipment itself.

For example, compromised hardware may be used to communicate with external servers, transmit information or provide a network connection for unauthorized activity.

The XCPE operation demonstrated how infected devices could be enrolled into residential proxy networks, allowing third parties to route internet traffic through connections belonging to unsuspecting users.

This can make malicious activity appear to originate from legitimate residential or business internet connections.

The presence of compromised equipment does not automatically mean that other systems on the same network have been accessed.

However, organizations should assess whether potentially affected devices could provide attackers with access to sensitive information or additional network resources.

Why Supplier Due Diligence Is Important

The incident raises broader questions about how businesses assess manufacturers and technology suppliers before purchasing connected products.

Many procurement decisions concentrate on functionality, availability, price and compatibility.

While these factors remain important, organizations should also consider the integrity and reliability of the companies responsible for developing and maintaining the technology.

Supplier Due Diligence may include examining corporate ownership, relevant regulatory history, business relationships and credible adverse information.

For higher-risk technology purchases, organizations may also consider technical security assessments, firmware provenance, update mechanisms and the manufacturer's history of responding to security vulnerabilities.

Relevant considerations include:

• The identity and ownership of the manufacturer.
• Whether equipment is supplied through authorized distribution channels.
• The security testing and certification processes applied.
• The manufacturer's procedures for firmware updates.
• Any relevant history of security incidents or regulatory concerns.
• The level of access equipment requires to internal systems.
• Whether products can be independently assessed before deployment.

Conflict International USA provides Due Diligence Services to organizations assessing commercial partners, suppliers and other third-party relationships.

Corporate Due Diligence can help establish relevant facts about a supplier, while specialist technical assessments may be required to evaluate the security of the equipment itself.

Neither process guarantees that deliberately concealed malicious functionality will be detected.

Google Disrupts Infrastructure Linked to Millions More Devices

The international operation extended beyond the original 1.3 million devices.

Google reported that criminal affiliates used the XCPE network to distribute additional malware, including programs capable of operating through other compromised systems.

By taking action against command-and-control infrastructure associated with these malicious programs, Google estimates that access to at least 10 million additional compromised devices may also have been disrupted.

The company took action against domains and servers used to operate the botnet and distribute malicious components.

However, disrupting the infrastructure does not necessarily remove malicious software from every affected device.

Where malware is embedded within firmware, ordinary application removal may be insufficient to eliminate the underlying compromise.

Google also acknowledged that criminal groups involved in these operations may establish alternative infrastructure or distribution mechanisms.

This distinction is important for organizations assessing the longer-term consequences of the takedown.

What Should US Businesses Consider?

The XCPE investigation illustrates why connected equipment should be treated as part of an organization's wider Cyber Security environment.

Businesses should understand which devices connect to their networks, whether those devices receive security updates and what communication they require to operate.

Appropriate protective measures may include:

• Maintaining an inventory of connected hardware.
• Restricting unnecessary internet access for operational devices.
• Separating higher-risk equipment from sensitive business systems.
• Reviewing firmware and security update arrangements.
• Monitoring unusual network communications.
• Assessing supplier security procedures before significant purchases.
• Investigating devices associated with credible compromise indicators.

The appropriate measures depend on the organization's infrastructure and the sensitivity of the systems involved.

Where potentially compromised equipment is identified, technical assessment may be required to determine whether continued use is appropriate.

Conflict International USA provides Cyber Security Services, including vulnerability assessments, penetration testing, Cyber Threat Monitoring and incident-response support.

These services can assist organizations in identifying technical weaknesses, assessing network exposure and establishing appropriate responses to suspected security incidents.

A Warning About Technology Supply Chain Security

Google's disruption of the XCPE botnet represents a significant development in efforts to combat malware embedded within connected hardware.

The investigation is particularly notable because the suspected compromise originated within a manufacturer's production environment, rather than solely through exploitation of an existing device vulnerability.

The findings demonstrate how trust placed in technology suppliers can create security exposure when equipment contains functionality that is not apparent to purchasers.

For US businesses, the wider lesson concerns the importance of combining technical Cyber Security controls with appropriate supplier assessment and ongoing oversight.

Organizations cannot eliminate every risk associated with complex technology supply chains. However, understanding how equipment is sourced, configured and connected can help identify vulnerabilities and inform proportionate protective measures.

Conflict International USA supports businesses, law firms and professional advisers through Cyber Security, Due Diligence and specialist investigative services.

Our team can assist organizations in assessing supplier-related concerns, identifying security exposure and developing factual information to support informed commercial decisions.

To discuss a Cyber Security assessment or a sensitive supplier Due Diligence requirement, contact Conflict International USA for a confidential consultation.