Google said it concluded that Videostrong intentionally embedded a backdoor in Android TV-box firmware and excluded the manufacturer and future related entities from certification. Its disruption targeted the XCPE botnet affecting more than 1.3 million devices; an estimate of at least 10 million additional devices affected by related infrastructure actions is a separate count. Google also strengthened certification tests for malicious components downloaded after initial boot. Server disruption does not itself clean firmware, and investigators found components capable of reinstalling after reboot.