谷歌与日本警方摧毁130万台电视盒僵尸网络，制造商视壮科技被指预装后门牟利
谷歌威胁情报团队（GTIG）11月2日宣布，谷歌与日本警察厅及多家网络安全公司已在10月最后一周捣毁一个名为 XCPE 的大型僵尸网络。超过130万台机顶盒（绝大多数是安卓电视盒）在出厂时就被预装了后门。谷歌表示，其以「高置信度」认定，这套后门与僵尸网络是中国深圳的设备制造商视壮科技（Videostrong Technology）为牟利而有意开发、部署和运营的。
谷歌的报告说，名为 x.cpe 的后门预装在设备固件的系统分区里，以系统级权限运行；用户即使删除，它也会在设备重启时自动重新安装，普通用户无法清除。视壮科技利用混淆手法钻了谷歌兼容性与安全测试的空子，让恶意代码在设备首次开机之后才加载，从而避过认证检测。谷歌称，运营者可以借这套后门远程截取屏幕、注入按键、窃取账号信息和设备数据，并能在用户不知情的情况下静默安装其他应用、关掉谷歌的安全校验。
谷歌称，视壮科技靠这套后门赚钱的方式，是把受感染设备的访问权出售给犯罪团伙，并为团伙在设备上加载各自的恶意模块。这些模块把用户家中的电视盒变成住宅代理的出口节点，用用户的家庭宽带转发流量；也被用来实施广告欺诈，或继续装入更多恶意软件。
规模方面，谷歌统计被 XCPE 纳入控制的机顶盒超过130万台，分布在200多个国家和地区；参与处置的安全公司 TrendAI 表示，其在2026年6月3日至10月1日期间观测到147万余台受感染设备，涵盖206个型号。受害设备以安卓电视盒为主，也包括远程医疗设备、卡拉OK机和数字标牌。谷歌称，下游团伙用来指挥其模块的服务器被捣毁后，犯罪团伙还将失去对至少1000万台其他受感染设备的访问。
处置上，谷歌已采取法律行动，拿下视壮科技用来控制僵尸网络和安装恶意模块的域名与服务器，并捣毁十余个借这条后门分发的恶意软件家族的指挥域名。谷歌同时终止与视壮科技的合作，禁止该公司及其今后的子公司、关联方生产和销售经认证的安卓设备，也不得再向其他认证厂商提供软件，并表示已着手改进对认证安卓电视设备固件完整性的检查。参与此次分析与处置的还有 Lumen、HUMAN Security、Plume 与 Synthient 等公司。
谷歌在报告中还提到，视壮科技自2024年末起调整了后门的架构，把恶意模块从后门本体中拆出，谷歌认为这可能与谷歌此前针对同类僵尸网络 BadBox 的执法行动有关。美国联邦调查局（FBI）曾在2025年6月警告，BADBOX 2.0 僵尸网络已把数百万台家庭联网设备变成住宅代理工具；谷歌随后在2025年7月就 BADBOX 2.0 起诉其运营者。
需要说明的是，上述对视壮科技的认定是谷歌基于调查作出的评估，相关指控尚未经过法院审理裁定；视壮科技截至发稿未公开发表回应。谷歌的报告没有公布受影响设备型号的完整清单，而这次被捣毁的是控制后门的服务器与域名，已经售出设备里的后门并不会因此自动消失。公开信息中，也未见中国主管部门就此事发布通报。
（来源：谷歌威胁情报团队）
Google and Japanese Police Dismantle Botnet of 1.3 Million TV Boxes; Maker Videostrong Accused of Planting Backdoor for Profit
The Google Threat Intelligence Group (GTIG) announced on Nov. 2 that Google, Japan's National Police Agency and several cybersecurity firms dismantled a large botnet known as XCPE in the last week of October. More than 1.3 million set-top boxes, the overwhelming majority of them Android TV boxes, had the backdoor installed before they left the factory. Google said it assesses with high confidence that the backdoor and the botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology, a device manufacturer based in Shenzhen, China.
According to Google's report, the backdoor, called x.cpe, is preloaded in the firmware's system partition and runs with system-level privileges. If a user removes it, it automatically reinstalls when the device reboots, putting it beyond the reach of ordinary users. Videostrong used obfuscation to slip through Google's compatibility and security testing, loading the malicious code only after a device's first boot so it evaded certification checks. Google said the operators could use the backdoor to capture screens remotely, inject keystrokes, steal account information and device data, silently install other apps without the user's knowledge, and switch off Google's security verification.
Google said Videostrong made money from the backdoor by selling access to the infected devices to criminal affiliates and loading those affiliates' malware modules onto the devices. The modules turned TV boxes in users' homes into exit nodes for residential proxy networks, routing traffic through household broadband connections. They were also used to commit advertising fraud or to load still more malware.
On scale, Google counted more than 1.3 million set-top boxes enrolled in XCPE, spread across more than 200 countries and regions. TrendAI, one of the security firms in the disruption, said it observed more than 1.47 million infected devices across 206 models between June 3 and Oct. 1, 2026. Most victims were Android TV boxes, but the infected devices also included telehealth equipment, karaoke machines and digital signage. Google said that taking down the servers the affiliate groups used to command their modules would also sever the criminals' access to at least 10 million additional compromised devices.
Google said it took legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules, and dismantled the command domains of more than a dozen malware families distributed through the backdoor. Google has cut ties with Videostrong and banned the company, and any future subsidiaries or affiliates, from building and selling certified Android devices or supplying software to other certified vendors. It also said it is improving how it checks the firmware integrity of certified Android TV devices. Lumen, HUMAN Security, Plume and Synthient also took part in the analysis and disruption.
Google's report also noted that from late 2024, Videostrong restructured the backdoor, splitting the malicious modules out of the backdoor itself, a change Google said may have been a response to its earlier enforcement against the related BadBox botnet. The FBI warned in June 2025 that the BADBOX 2.0 botnet had turned millions of home internet-connected devices into residential proxy tools, and Google sued the operators of BADBOX 2.0 the following month.
It should be noted that the attribution to Videostrong is an assessment Google made from its investigation; the allegations have not been adjudicated in court. Videostrong had not publicly responded as of publication. Google's report did not publish a full list of affected device models, and what was dismantled was the servers and domains controlling the backdoor: the backdoor inside devices already sold will not disappear on its own as a result. No public notice on the matter from Chinese regulators has been seen in publicly available information.
(Source: Google Threat Intelligence Group)
来源：谷歌威胁情报团队
发布：GSM·美国（发布链接）
图片来源：图：一台安卓电视盒与遥控器（资料图，非涉事厂商产品）。照片：Oliwier Jaszczyszyn／kontrabanda.net，CC BY-SA 4.0，经 Wikimedia Commons。 / Photo: An Android TV set-top box and its remote (file photo; not a product of the maker named in this story). Photo by Oliwier Jaszczyszyn / kontrabanda.net, CC BY-SA 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
