Google Leads Global Effort to Shut Down Videostrong‑Linked XCPE Botnet

Google, in collaboration with several cybersecurity firms and law‑enforcement agencies, announced the successful dismantling of the XCPE botnet, a network of compromised devices that security researchers traced back to the Chinese hardware manufacturer Videostrong.

The operation, which unfolded over several months, involved the identification of thousands of infected routers, cameras and IoT gadgets worldwide. By coordinating sink‑hole servers and issuing takedown notices to domain registrars, the coalition forced the command‑and‑control infrastructure offline, effectively neutering the botnet's ability to launch further attacks.

XCPE first surfaced in early 2023 when security analysts observed a surge in traffic aimed at exploiting default credentials on network devices. The botnet was later linked to large‑scale phishing campaigns and distributed‑denial‑of‑service attacks that targeted both commercial websites and critical infrastructure. Investigators noted a distinctive code fingerprint that pointed to firmware supplied by Videostrong, a company known for producing low‑cost surveillance equipment exported to multiple continents.

Google’s role centered on its threat‑intelligence platform, which supplied real‑time data on malicious IP addresses and domain registrations associated with the botnet. Partner firms, including several managed‑detection‑response providers, contributed forensic analysis and helped isolate compromised hardware in the field. Law‑enforcement representatives from at least three countries coordinated the legal steps needed to seize control of the botnet’s servers.

Experts say the takedown underscores the growing necessity of public‑private cooperation in combating IoT‑based threats. As more everyday devices become internet‑connected, attackers increasingly exploit weak default passwords and unpatched firmware. The XCPE case illustrates how a single manufacturer’s insecure product line can become a global security liability.

While the immediate threat has been mitigated, analysts warn that the underlying vulnerabilities remain. They recommend that owners of Videostrong devices, as well as similar equipment, apply firmware updates, change default login credentials, and consider network segmentation to limit exposure. Google and its partners have pledged to continue monitoring for any resurgence of the botnet’s activity and to work with manufacturers to improve security standards across the IoT ecosystem.