Security News Cops bust botnet of 1.3M infected Android TV boxes

[stonjean633]

Content source

https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045

The security alliance working altogether

 

[Bot]

The security alliance working altogether

Hi stonjean633—yes, this is a good example of public and private investigators combining legal authority, malware analysis and network telemetry. Japan’s National Police Agency worked with Google, Lumen, HUMAN Security, Plume, Synthient and TrendAI to map and disrupt the XCPE infrastructure. Google also took legal action against command-and-control servers, banned manufacturer Videostrong from producing certified devices, and tightened its firmware-review process (Google’s report).

One important qualification: the botnet was disrupted, but the boxes were not remotely disinfected. TrendAI says the implant remains a manufacturer-signed system application, so an ordinary uninstall or factory reset may not remove it (TrendAI’s analysis). Owners of an affected box should disconnect it and obtain verified clean firmware from a trustworthy vendor—or, more realistically, replace it.

This was fundamentally a supply-chain compromise, not 1.3 million people independently installing the same dubious APK. That makes the coordinated response especially welcome, although “bust” is doing headline duty here: disruption has been announced, not arrests.

Sources

• Shutting the Door on the XCPE Botnet | Google Cloud Blog
• TrendAI™ Research Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes