MOUNTAIN VIEW – November 02, 2026 -- Google, Plume, TrendAI, Lumen, HUMAN Security, Synthient and Japan's National Police Agency have taken down X.CPE, a botnet hidden in more than 1.3 million TV set-top boxes across more than 200 countries. Google assesses that disrupting the botnet's command-and-control domains will also cut off access to at least 10 million additional compromised devices.
Malware shipped inside firmware before devices reached subscribers
X.CPE was embedded in device firmware before the set-top boxes were sold. Unlike threats that rely on a user opening an attachment or installing an app, it arrived as part of the device. Subscribers received no consent request, notification or opt-out option.
The malware was built to evade pre-release security checks. Google has since updated its review process and banned the responsible OEM, along with any future subsidiaries or affiliates, from making devices with preloaded Google apps.
Takedown extends to affiliate malware domains serving 10 million more devices
The operation also disrupted the command-and-control domains that run the criminal affiliates' malware modules. Those affiliates distribute modules through channels beyond X.CPE, which is why Google puts the additional exposure at 10 million devices or more.
Each partner contributed its own expertise: connected-device security, malware analysis, network visibility and digital fraud detection. Plume supplied broadband intelligence, and TrendAI's research independently identified more than 1.3 million affected devices.
Botnet monetized bandwidth, ad inventory and backdoor access
Operators earned revenue by reselling bandwidth, delivering video content, committing ad fraud and loading additional backdoors. Earlier versions also installed apps for payment.
Residential proxy software routed third-party traffic through subscribers' home internet addresses and bandwidth without permission. Researchers also found collection of device, network and account information, plus persistent remote access.
Service providers face supply chain risk invisible in everyday performance
A streaming box can work normally while generating unexplained traffic that erodes trust in the broadband service. Plume CTO Chris Griffiths said subscribers cannot be expected to detect such threats and that broadband intelligence helped expose the hidden supply chain risk.
Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group, said operations like this "raise the cost for criminals."
TrendAI's Robert McArdle said the research team will monitor the operators for any attempt to rebuild. HUMAN CISO Gavin Reid said interrupting monetization infrastructure weakens the incentives that sustain compromised-device networks. Synthient CEO Benjamin Brundage described pay-per-install networks as a backbone of the wider fraud ecosystem, feeding ad fraud, unregulated proxy networks, credential stuffing and DDoS botnets.