Google and partners disrupt XCPE botnet of more than 1.3 million Android TV boxes

The XCPE backdoor was built into device firmware and gave operators remote control of infected boxes. Google accuses Videostrong of installing it deliberately and selling access to criminal affiliates, who used devices for ad fraud and proxy traffic. The takedown also targeted servers used by related malware families, which Google says cut off access to at least 10 million other compromised devices.