D5/100
Malware · high
Backdoor Found in Firmware Partition of 1.3 Million Set-Top Boxes
Tier D · Background noise – Good to know
Who’s exposed: About 1.3 million set-top boxes with the backdoored firmware partition
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild · Full takeover
The Brief
- On 2 November 2026, Google Threat Intelligence Group disclosed that Google and its partners dismantled XCPE, a backdoor.
- The backdoor was found in the firmware partition of about 1.3 million set-top boxes.
- The source describes the threat as a botnet: a network of compromised devices controlled by a remote operator.
Why it matters
Devices with a backdoor in their firmware can be controlled remotely by an operator, so affected networks may be used for fraud or rented-out botnet activity.
The checklist behind the tier
Checklist · 2 of 10 yes
| No | Hits tech teams | Judgment: set-top boxes are consumer home devices, not software developers, ops or IT teams run or build with. |
| No | Core infrastructure | Judgment: a consumer set-top box firmware backdoor is not core infrastructure nearly every team runs. |
| No | Popular tool | Judgment: set-top box firmware is not a widely used developer framework, tool, platform, OS or package. |
| Yes | Exploited in the wild | DEV Community: Google Threat Intelligence Group disclosed a botnet backdoor (XCPE) and dismantled it with partners. |
| No | Public exploit | DEV Community summary does not say exploit code or a proof-of-concept was published. |
| No | Remote, no login | DEV Community summary does not state how the devices were reached or whether authentication was needed. |
| Yes | Full takeover | DEV Community: a backdoor let a remote operator control the compromised devices in a botnet. |
| No | Secrets exposed | DEV Community summary does not report credentials, tokens, keys or customer data being stolen or exposed. |
| No | Supply chain | DEV Community summary does not say the backdoor was shipped through an official update or build channel. |
| No | No fix yet | DEV Community summary does not say whether a patch or fixed firmware is available. |
Timeline
Google Threat Intelligence Group discloses that Google and partners dismantled the XCPE backdoor
DEV Community: ai
A Backdoor Sat in the Firmware Partition of 1.3 Million Set-Top Boxes
Source
A Backdoor Sat in the Firmware Partition of 1.3 Million Set-Top Boxes ↗ DEV Community: ai · 3h ago
First seen · 1 source · Full story page · How tiers are decided