XCPE Botnet: What 1.3 Million Compromised IoT Devices Mean for Business Security

Google says it and industry partners dismantled a backdoor that had enrolled more than 1.3 million Android set top boxes into the XCPE botnet. The most important lesson for businesses is not limited to television hardware. Connected devices can arrive with software, services, or supply chain risks that traditional endpoint security may never see. If a smart device can reach your business network, it belongs inside your cybersecurity perimeter.

By CompuAce Team Published November 5, 2026 Reviewed against Google Threat Intelligence, FBI, NIST, and CISA guidance as of November 5, 2026

The Short Version

On November 2, 2026, Google Threat Intelligence Group disclosed the disruption of XCPE, a botnet built around a backdoor found on more than 1.3 million Android based set top boxes. Google says the backdoor was built directly into device firmware and maintained persistent system level access.

Google assesses with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co. According to Google, access to compromised devices was monetized through third party modules used for residential proxy services, ad fraud, and additional malware delivery.

Google also disrupted command and control infrastructure used by affiliate malware families. Because those modules were distributed through channels beyond XCPE, Google estimates that the disruption will sever access to at least 10 million additional compromised devices. That figure is separate from the 1.3 million devices enrolled directly in the XCPE botnet.

The business lesson:

The device you forgot about may have more network access than it needs. Smart TVs, streaming boxes, digital signage, meeting room equipment, cameras, projectors, and other connected hardware should be inventoried, segmented, monitored, and purchased with the same security discipline applied to laptops and servers.

What Is the XCPE Botnet?

XCPE is the name Google uses for a modular backdoor and botnet ecosystem found primarily on Android TV set top boxes. Google says the malware had evolved over time from simpler droppers into a multi stage architecture designed for persistence, remote control, and monetization.

The primary backdoor ran with Android system privileges and was stored in firmware. Google says that if a user removed the package, it could reinstall itself from the device firmware after reboot. That made the compromise fundamentally different from a normal unwanted application that can simply be uninstalled.

Google observed the botnet receiving instructions through command and control infrastructure and loading additional software modules onto infected devices. Those modules could transform the device into a residential proxy exit node, an ad fraud engine, or a platform for additional malicious software.

The Device Did Not Need to Be Hacked After Purchase

One of the most important parts of Google's disclosure is that the malicious software was found built directly into many different device models and brands over multiple years.

Google says the operators used obfuscation techniques that allowed malicious code to load after the device's first boot. Google has since changed parts of its review process and says it banned Videostrong and future subsidiaries or affiliates from building devices with preloaded Google apps or supplying software to certified vendors.

This is a hardware and firmware supply chain problem. A business can configure a firewall correctly, require MFA, patch Windows, and still introduce a new security risk simply by connecting an untrusted smart device to the same network.

The FBI has warned about the same broader class of risk. In its BADBOX 2.0 public service announcement, the FBI said compromised IoT devices included TV streaming devices, digital projectors, vehicle infotainment systems, digital picture frames, and other connected products. The FBI noted that some devices were configured with malicious software before purchase or became infected during setup.

What Could the XCPE Backdoor Actually Do?

Google documented capabilities that go well beyond unwanted advertising. Depending on the module and configuration, compromised devices could support:

Silent application installation
Remote shell command execution
Screen capture
Keystroke injection
Network reconnaissance
Device and package inventory collection
System log collection
Additional malware installation
Residential proxy activity
Advertising fraud

Google says it observed operators performing sensitive actions such as capturing live screenshots, injecting keystrokes, collecting account and device information, and running shell commands. These capabilities make the issue relevant to any environment where an affected device has unnecessary access to business systems or sensitive traffic.

What Is a Residential Proxy Botnet?

A residential proxy routes someone else's traffic through an internet connection that appears to belong to an ordinary home or business. When compromised devices are used as proxy exit nodes, third party traffic can leave the internet through the victim's public IP address.

That can make malicious or abusive traffic harder for online services to distinguish from normal user activity. It can also create operational and reputational problems for the owner of the internet connection, even if that organization never knowingly installed proxy software.

Google specifically warns consumers to be cautious about applications that offer payment for unused bandwidth or internet sharing because such services can be used to grow proxy networks and may introduce additional security risk.

Why This Matters to Businesses, Not Just Home Users

XCPE primarily affected Android TV set top boxes, but Google also observed other Android based IoT devices, including telehealth devices, karaoke machines, and digital signage systems.

Businesses routinely deploy devices that do not look like traditional computers:

Smart TVs in conference rooms
Streaming and presentation boxes
Digital signage players
Video conferencing hardware
Security cameras
Printers and multifunction devices
Building automation controllers
Projectors
Voice assistants
Telehealth and kiosk devices
Warehouse or retail tablets
Network connected appliances

These devices often receive less scrutiny than laptops because they are purchased by facilities, marketing, operations, retail, or another department rather than IT. That creates an asset visibility problem before it becomes a security problem.

The Device You Forgot About May Have More Network Access Than It Needs

A device used only to display a presentation or play a video should not normally need unrestricted access to file servers, databases, employee workstations, accounting systems, backup infrastructure, or administrative interfaces.

Yet flat networks often allow exactly that. When every device shares the same trusted network, compromise of a low value device can expose a much larger environment than the device's business purpose requires.

This is why asset inventory and network architecture belong together. You cannot meaningfully segment devices that nobody knows exist.

Why Network Segmentation Matters

Network segmentation separates systems based on function, trust level, sensitivity, or operational requirement. For IoT devices, that often means placing them on a dedicated network or VLAN and restricting which internal and external destinations they can reach.

NIST guidance explicitly notes that network segmentation can logically separate IoT devices from the rest of a system when the device itself cannot support all required security controls. CISA's microsegmentation guidance similarly notes that IoT and legacy devices often have limited built in protections, increasing the need to restrict access to and from those resources.

Segmentation does not make a malicious device safe. It can reduce the blast radius by limiting what that device can see, contact, or attack.

A practical principle:

A conference room streaming device should receive only the network access required to do its job. It should not inherit the same trust as an employee workstation or server.

Monitor What IoT Devices Actually Do on the Network

NIST has emphasized that understanding expected IoT network behavior makes it possible to create appropriate firewall rules and identify abnormal activity that may indicate compromise.

That means businesses should not only ask what a device is. They should also ask what it communicates with.

Useful questions include:

Which DNS names does the device query?
Which external IP addresses does it contact?
Does it initiate connections that are unrelated to its business purpose?
Does traffic volume change unexpectedly?
Does the device communicate with other internal systems?
Does it need internet access at all times?
Is the manufacturer still publishing firmware updates?

Baseline behavior makes it easier to detect when a device starts doing something it was never purchased to do.

How to Identify Unmanaged Devices on a Business Network

The starting point is a complete inventory. IT asset management should include more than employee computers and servers.

Businesses can reconcile several sources:

DHCP lease records
DNS logs
Firewall device and traffic data
Switch MAC address tables
Wi Fi controller inventories
Network discovery tools
Endpoint and security platforms
Procurement records
Facilities and conference room inventories
Digital signage and retail system inventories

The goal is not simply to count devices. Each device should have an owner, a purpose, a network location, a manufacturer, a firmware or software status, and an expected lifecycle.

Cheap Hardware Can Create Expensive Security Problems

Procurement decisions are cybersecurity decisions when the product connects to a network.

NIST's 2026 IoT guidance emphasizes that manufacturers need to provide both cybersecurity capabilities and information that customers can use to reduce risk. Before purchasing a connected device, businesses should therefore evaluate more than price and features.

Review:

Manufacturer reputation and support history
Firmware update mechanism
Security update commitment
Product lifecycle and end of support policy
Default services and credentials
Ability to change passwords and disable unnecessary features
Network requirements
Management and logging capabilities
Whether the device can operate on a segmented network
Whether the product comes from a supported and verifiable supply chain

Should Consumer IoT Devices Be on the Corporate LAN?

Usually, a consumer grade smart device should not receive the same network trust as managed business endpoints unless there is a clear technical reason and appropriate security controls.

A more defensible approach is to place low trust devices in a dedicated segment with restricted communication. That segment can allow necessary internet access while preventing unnecessary access to business systems.

High value or sensitive environments may require stronger controls, including dedicated hardware, enterprise managed alternatives, tighter firewall rules, separate physical infrastructure, or removal of devices that cannot meet minimum security requirements.

The 15 Point Business IoT Security Checklist

Inventory every connected device. Include conference rooms, signage, printers, cameras, projectors, and appliances.
Assign an owner and business purpose. Every device should have someone accountable for it.
Identify the manufacturer and model.
Verify firmware and software support.
Replace unsupported or questionable hardware.
Change default credentials.
Disable unnecessary services and features.
Separate IoT devices from trusted business systems.
Restrict outbound internet access where practical.
Restrict internal east west traffic.
Monitor DNS and network behavior for anomalies.
Keep an approved vendor and procurement process.
Document update and replacement cycles.
Include IoT devices in incident response planning.
Review the inventory regularly. New devices should not become permanent blind spots.

What South Florida Businesses Should Do

The XCPE botnet was global. It was not a South Florida specific incident. But businesses in Miami, Miami Lakes, Fort Lauderdale, Broward County, and the wider region use the same classes of connected hardware found in offices around the world.

Small and mid sized businesses can be especially exposed when purchasing and network decisions are distributed across departments. Marketing may install digital signage. Operations may add a streaming box. Facilities may deploy cameras. A conference room may receive a smart TV. None of those purchases may pass through normal endpoint management.

That is why network visibility matters. A device does not need to look like a PC to become part of the attack surface. Continuous visibility is also the core argument in our guide to 24/7 cybersecurity monitoring for small businesses, and the same "trusted by default" assumption is what attackers abused in Microsoft Teams help desk impersonation.

How CompuAce Helps Reduce IoT and Network Risk

CompuAce helps businesses understand what is connected to their environment, how those devices communicate, and whether they have more access than their purpose requires.

Relevant areas include:

Network and device inventory
IT asset visibility and lifecycle management
Network segmentation and VLAN design
Firewall policy and access review
24/7 monitoring and threat detection
SMB cybersecurity
Infrastructure and network support
IoT procurement and lifecycle planning
Incident response and recovery planning

Explore CompuAce SMB Security, IT Asset Management, our IT solutions, and our editorial and sourcing standards.

Do You Know Everything Connected to Your Business Network?

Laptops and servers are only part of the attack surface. CompuAce can help identify unmanaged devices, improve network segmentation, review asset visibility, and monitor suspicious activity across your environment.

Review Your Network & IoT Security

XCPE Botnet and IoT Security FAQ

What is the XCPE botnet?

XCPE is the name Google uses for a backdoor and botnet ecosystem found on more than 1.3 million Android based set top boxes. Google says the software was built into device firmware and used to install additional modules for activities such as residential proxy services, ad fraud, and additional malware delivery.

How many devices were affected by XCPE?

Google says more than 1.3 million set top boxes were enrolled in the XCPE botnet. It also says disruption of command and control domains used by affiliate modules is expected to sever access to at least 10 million additional compromised devices distributed through channels beyond XCPE.

Was XCPE installed before customers bought the devices?

Google says malicious software was built directly into many device models and brands over multiple years. The backdoor was preloaded in firmware and designed to maintain persistent system level access.

Why is this relevant to businesses?

Businesses often connect smart TVs, set top boxes, digital signage, meeting room devices, telehealth equipment, projectors, cameras, and other IoT devices to networks that also carry business traffic. A compromised unmanaged device can create a blind spot, generate malicious traffic, expose internal network information, or become a foothold for further abuse.

What is a residential proxy botnet?

A residential proxy botnet routes third party traffic through compromised consumer or business internet connections. To external services, that traffic may appear to originate from the legitimate IP address of the victim device or network.

Should IoT devices be placed on a separate network?

In many environments, yes. NIST and CISA guidance support segmentation as a way to reduce the risk created by IoT and legacy devices, especially when those devices have limited security controls. Segmentation should restrict communications to only what the device needs.

What should a business check before buying an IoT device?

Review the manufacturer, firmware support policy, update mechanism, security features, management options, network requirements, expected lifecycle, and whether the product comes from a reputable and supported supply chain. Businesses should also decide how the device will be segmented and monitored before it joins the production network.

How can a business find unmanaged IoT devices?

Start with a current asset inventory, DHCP and DNS records, switch and Wi Fi controller data, firewall logs, endpoint or network discovery tools, and a review of conference rooms, signage systems, cameras, printers, streaming devices, and other equipment that may not be managed like a normal workstation.

Sources & Editorial Transparency

This article prioritizes first party security research and public guidance. Claims about XCPE are based on Google Threat Intelligence Group's November 2, 2026 disclosure. General IoT security recommendations are supported by FBI, NIST, and CISA guidance. CompuAce reviewed these sources on November 5, 2026.

Editorial note: Google continues to investigate the XCPE ecosystem and related affiliate modules. Device models, infrastructure, and vendor actions can change after publication. Organizations should verify current manufacturer and platform guidance before making production changes.

By CompuAce Team | November 5, 2026

Schedule a Consultation | View Our Solutions | Back to Blog

The Smart Device on Your Network Could Already Be a Botnet Node