What Happened
Google led a takedown of the x.cpe botnet after it lost control of its servers in late October, The Hacker News reports. The botnet infected more than 1.3 million Android devices, mostly TV set-top boxes. Operators sold access for ad fraud and residential proxy services.
Google says it is highly confident Shenzhen-based Videostrong built the backdoor into the boxes on purpose. It banned the company from building or supplying certified Android devices. Trend Micro’s TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1. The backdoor survives reboots, and owners cannot remove it. Google expects the action to cut criminals off from at least 10 million more infected devices.
Why This Matters for Canadian Organizations
Low-cost Android TV boxes sell through online marketplaces to households and small businesses across Canada. Offices, clinics, restaurants, and waiting rooms plug them into the same networks as laptops and point-of-sale terminals. A box with a built-in backdoor sits inside your network by design.
Residential proxy services make the risk worse. Criminals route fraud and attacks through the home and business IP addresses of infected boxes. Your address then appears in abuse logs, and your staff or customers lose access to banking and cloud services. Canadian internet providers and security teams also gain a harder attribution problem because the traffic looks local.
This incident confirms a trend we track in our Trends coverage. Supply chain compromise now starts at the factory.
What to Do
Inventory every streaming box and smart TV on your networks, including staff home offices. Compare models against the 182 names Synthient published. Replace any match with a certified Android device from a known vendor, because software cleanup will not remove the backdoor. Move all media and IoT devices onto a separate network segment with no route to business systems. Block unexpected outbound proxy traffic at the firewall. Add a purchasing rule requiring certified devices from approved vendors. Read more in our news section.
