Google, in collaboration with industry partners, has dismantled the XCPE backdoor, which had conscripted over 1.3 million Android set-top boxes into a botnet. Google is highly confident that Android ODM manufacturer Voit Technology intentionally built and operated the backdoor for profit, selling access to criminal affiliates involved in ad fraud and residential proxies. The takedown of the associated command-and-control (C2) domains is expected to cut off access to at least 10 million additional infected devices. The malware employs a modular three-stage architecture and communicates via MQTT. Google has banned Voit Technology from producing certified Android devices.