Tech

Shutting the Door on the XCPE Botnet (Threat Intelligence)

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 02/11/2026, 14:50:24 UTC.

Briefings

Google and industry partners successfully dismantled the XCPE botnet, which had enrolled over 1.3 million set-top boxes. Videostrong Technology Co., an OEM and ODM, was identified as the primary operator who monetized the backdoor for financial gain by selling access to criminal affiliates. These affiliates conducted ad-fraud operations and loaded malware onto compromised devices, including residential proxy networks. The incident occurred in late 2026, marking the end of a previously active threat campaign.

Key points

• Videostrong Technology Co. was identified as the primary operator of the XCPE botnet, which enrolled over 1.3 million set-top boxes.
• The botnet operated via a backdoor developed and deployed by Videostrong for financial gain through criminal affiliates.

Context

The XCPE botnet was a previously active threat campaign targeting set-top boxes, which Google and partners recently dismantled. Videostrong Technology Co. was identified as the primary operator, monetizing the backdoor for financial gain by selling access to criminal affiliates.

Limitations

Evidence covers the dismantling of the botnet and identifies Videostrong as the primary operator. Specific details on affiliate operations, malware payloads, or exact financial gains are not provided. The incident occurred in late 2026, and the scope of affected devices is limited to the 1.3 million set-top boxes mentioned.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 02/11/2026, 14:51:29 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeigrz7od6p3xj5d4y3hltelwufqmatfv246o37y5fcylbacxesiqre