Shutting the Door on the XCPE Botnet
Comments on “Shutting the Door on the XCPE Botnet”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Google and partners including Japan's National Police Agency, Lumen, HUMAN Security and TrendAI dismantled XCPE, a firmware backdoor that enrolled over 1.3 million mostly Android TV boxes. Google's threat intelligence group assesses with high confidence that OEM Videostrong built and ran it for profit, selling access to proxy and ad-fraud affiliates. Google says the firm loaded code after first boot to evade certification tests, and it has banned Videostrong and revised its firmware review. These are Google's own assessments.
Why it ranked
No. 4 of 107 with a score of 0.71. The panel rated it highest on technical depth (0.95) and substantiated (0.92), lowest on audience breadth (0.60). Placed No. 4, No. 5 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Detailed threat-intel disclosure of a large Android TV botnet with strong technical specifics and evidence; security-focused, high technical depth, moderate breadth beyond security and hardware teams.
- AI judgeJudge 3gpt-5.6-luna
- A highly consequential supply-chain botnet report with detailed Android internals, C2 behavior, monetization modules, infrastructure, hashes, and disruption actions. It is vendor-authored and includes advocacy, but the technical evidence is extensive and actionable.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.71total under rubric v2.3
- Significance0.74
- Reader interest0.79
- Audience breadth0.60
- Practical relevance0.70
- Substantiated0.92
- Technical depth0.95
- New information0.91
- Counts against: Promotional0.11
- Counts against: Overclaim0.23
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.60 | 0.90 | 0.74 | 0.30 | +0.24 | +0.177 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.72 | 0.70 | 0.95 | 0.79 | 0.25 | +0.26 | +0.205 |
| Audience breadthHow many people who build technology does it concern? | 0.61 | 0.50 | 0.70 | 0.60 | 0.20 | +0.13 | +0.079 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.77 | 0.55 | 0.80 | 0.70 | 0.25 | +0.22 | +0.155 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.91 | 0.90 | 0.95 | 0.92 | 0.05 | +0.05 | +0.046 |
| Technical depthHow technically substantive is it? | 0.99 | 0.90 | 0.95 | 0.95 | 0.10 | +0.05 | +0.047 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.94 | 0.90 | 0.90 | 0.91 | 0.04 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.08 | 0.10 | 0.15 | 0.11 | 0.07 | −0.19 | −0.021 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.39 | 0.20 | 0.10 | 0.23 | 0.29 | −0.11 | −0.025 |
| Sum of contributions | +0.709 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.709 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-03/4/"><img src="https://rubric.hrih.si/badge/2026-11-03/4.svg" alt="Ranked #4 on Rubric, 3 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Google and partners dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes into a botnet.
The article gives no link or citation for it.
The article says “Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet”
The source says No source to compare with.
No source givenCausal conclusion
Google assesses with high confidence that Videostrong Technology Co. intentionally developed, deployed and operated the backdoor and botnet for financial gain.
The article gives no link or citation for it.
The article says “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co”
The source says No source to compare with.
No source givenNumber
Taking down the affiliates' C2 domains will sever access to at least 10 million additional compromised devices.
The article gives no link or citation for it.
The article says “we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices”
The source says No source to compare with.
No source givenCausal conclusion
Google banned Videostrong from making devices with preloaded Google apps and cut ties with it.
The article gives no link or citation for it.
The article says “Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps”
The source says No source to compare with.
No source givenCausal conclusion
Videostrong used obfuscation to exploit a gap in Google's compatibility and security tests and loaded malicious code after the device's first boot.
The article gives no link or citation for it.
The article says “Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot”
The source says No source to compare with.
No source givenDate
In late 2024 Videostrong removed malicious modules from x.cpe and introduced the separate loader com.abc.nexus, possibly in response to earlier Google enforcement related to BadBox.
The article gives no link or citation for it.
The article says “In late 2024 – possibly as a response to earlier Google enforcement related to BadBox – Videostrong removed malicious modules from x.cpe and introduced a separate malicious package they developed,…”
The source says No source to compare with.
No source givenNumber
The Popanet malware loaded on XCPE devices is identical to the malware in Google's previous NetNut disruption, and its C2 infrastructure was taken down in that earlier disruption.
The article gives no link or citation for it.
The article says “This malware is identical to the malware described in our previous disruption of NetNut. All C2 infrastructure used by Popanet samples connected to x.cpe was taken down as part of…”
The source says No source to compare with.
No source givenGeneralization
Silent opt-in without user consent is the most prevalent means by which devices are turned into residential proxy exit nodes, and proxy operators only seek consent when forced by platform policy.
The article gives no link or citation for it.
The article says “Silent opt-in without user consent remains the most prevalent means by which devices are turned into exit nodes”
The source says No source to compare with.
Also covered by
Elsewhere
Elsewhere: HN 5 pts, not on front page
Recorded for context only, checked 3 Nov 2026, 05:47 UTC. It played no part in the ranking.