Threat Intelligence
Get the briefing
Threat Intelligence

Google and Partners Take Down XCPE Botnet Built on 1.3 Million Infected Devices

Dark Reading · 5 Nov 2026
Key Takeaway Keep an inventory of every set-top box and IoT device on your business network, buy only from vendors you trust, and keep these devices separate from systems that hold business data.

Google and its partners have disrupted a botnet known as XCPE, which was made up of around 1.3 million devices. According to the report, the infected devices included set-top boxes and other internet-connected (IoT) products.

Google alleges that Android device manufacturer Videostrong ran the operation. The devices were infected with a backdoor, which gave operators hidden access and created infrastructure that could be used for criminal activity.

The summary available does not detail how the takedown was carried out or which specific criminal activities the network supported. It does show how everyday connected devices can be turned into tools for crime without their owners knowing, and that the risk can sit in the products themselves rather than only in how they are used.

botnet IoT security Google Android supply chain
Read original source -> Get the briefing Get the news API, A$10 a month
Answering to more than one framework? Run them as one security and AI governance programme ->

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.