# Google Disrupts Android Botnet

Google and industry partners disrupted the XCPE botnet, which was reportedly embedded by former Android device partner Videostrong in more than 1.3 million devices, including TV set-top boxes and other connected equipment. Google says it removed malicious components and ended its relationship with Videostrong; the operation also disrupted command-and-control access associated with malware affecting at least 10 million additional devices. No government contract or procurement opportunity is identified, but the incident highlights risks in connected-device supply chains used by government organizations and contractors.

- Procurement teams should assess device manufacturers and upstream suppliers, and use independent security testing to check firmware and device integrity before purchase.
- For connected devices already in service, contractors should emphasize post-deployment monitoring and controls for trusted manufacturers, as the reported activity involved concealed malware and evolving configurations.
- Device suppliers may face greater buyer scrutiny around firmware integrity, supply-chain transparency, and their ability to detect and remediate compromise.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 03, 2026

### Government Entities
- Japan National Police Agency (NPA)

### Vendors
- Videostrong Technology Co. (Android device manufacturer and former Google business partner)
- Google (Lead botnet disruption participant)
- Lumen Technologies (Botnet research and disruption participant)
- Plume (Botnet research and disruption participant)
- Synthient (Botnet research and disruption participant)

### Key Quotes
> The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections
> — Charley Snyder, Head of disruption operations, Google Threat Intelligence Group

### Sources
- [Google alleges Chinese Business Partner turned Android Devices into Spying Gadgets - Cybersecurity Insiders](https://www.cybersecurity-insiders.com/google-alleges-chinese-business-partner-turned-android-devices-into-spying-gadgets) - Cybersecurity Insiders
- [Google shuts down global botnet running on certified Android devices | CyberScoop](https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices) - CyberScoop