Google, Plume, TrendAI™, Lumen, HUMAN Security, Synthient, and Japan's National Police Agency have coordinated a joint operation combining security research, threat intelligence, and cybersecurity expertise to identify and dismantle the X.CPE botnet.
Mountain View, California, USA, November 2, 2026 /PRNewswire/ — Today, a coalition of private and public sector partners announced the coordinated takedown of X.CPE, a global botnet hidden within over 1.3 million set-top boxes across more than 200 countries. The malware was pre-installed on devices prior to sale, exploiting subscribers’ devices and home internet connections without their knowledge or consent. This takedown effort was led by Google, Plume, TrendAI™, Lumen, HUMAN Security, and Synthient, with participation from Japan’s National Police Agency.
Charley Snyder, head of the Google Threat Intelligence Group’s takedown operations, said: “These operations increase the costs for criminals and demonstrate that the infrastructure they rely on is not beyond reach. Taking down X.CPE requires collaboration among industry partners. This proves that collaboration is one of our most powerful tools for addressing threats that cross borders and industries.”
A familiar device, hiding an unfamiliar threat
X.CPE is embedded in the firmware—the software that controls the device’s basic operations—and is pre-installed before the set-top box reaches the subscriber’s home. X.CPE is designed to evade pre-market security checks; in response, Google has since updated its review process and banned the affected original equipment manufacturers (OEMs), along with any future subsidiaries or affiliated companies, from producing devices preloaded with Google apps. Unlike infections that rely on users opening suspicious attachments or installing apps, this threat arrives as an intrinsic part of the device itself. Subscribers received no consent requests, notifications, or opt-out options.
Google, Plume, TrendAI™, Lumen, HUMAN Security, and Synthient, in coordination with Japan’s National Police Agency, conducted a coordinated takedown operation against X.CPE. Each organization leveraged its specialized expertise in connected device security, malware analysis, network visibility, and digital fraud to analyze and disrupt the botnet’s operations.
These organizations collectively dismantled a threat hidden behind seemingly ordinary device activity: software embedded in TV set-top boxes provided remote access to botnet operators, enabling them to exploit home broadband connections without subscribers' consent. This takedown also disrupted the command-and-control domains used to operate malicious software modules linked to criminal actors. Because these actors distributed their modules through channels beyond X.CPE, Google believes that shutting down these domains will cut off access for at least an additional 10 million infected devices.
This action highlights the critical importance of connecting intelligence across organizations to address threats that span technological and network boundaries. Partners contributed diverse perspectives on infected devices, malware, and internet traffic, enabling this coordinated takedown aimed at disrupting unauthorized access and monetization, while mitigating risks to subscribers' privacy, broadband resources, and trust in connected devices.
Turning home broadband into a business without permission
The botnet generates revenue from infected devices through various methods, including reselling bandwidth, delivering video content, ad fraud, loading additional backdoors, and installing paid apps in earlier versions.
For service providers, these findings highlight supply chain risks that may not be apparent from the device’s everyday performance. A streaming box that operates normally could still generate unexplained traffic and undermine trust in broadband services.
Complementary expertise and coordinated actions
The partner supported the X.CPE cleanup initiative led by Google:
- TrendAI™: Robert McArdle, Director of Cybercrime Research at TrendAI™, said, “We applaud Google’s decisive action to eliminate this threat. Our research identified over 1.3 million devices affected by this campaign, meaning millions of households and businesses are completely unaware their devices are being used as tools for active criminal activity—whether to deceive advertisers or to leverage their connections through residential proxies for other attacks, often including identity theft by impersonating individuals from their region. This action by Google and its research partners has significantly slowed these attackers, and if they attempt to rebuild, our TrendAI research will continue to monitor them closely.”
- Gavin Reid, Chief Information Security Officer at HUMAN, said: “The infected device networks persist because of profit: operators take control of devices and home connections without consent, then monetize this access through proxy services and various fraudulent activities. As this operation demonstrates, collaborative efforts disrupt the infrastructure needed for monetization, increase the cost of operating these networks, and undermine the incentives that sustain them.”
- Synthient: Benjamin Brundage, CEO of Synthient, said, "Illegitimate pay-per-install networks serve as a critical pillar for a broader fraud ecosystem, enabling activities ranging from direct ad fraud to unregulated affiliate networks, which in turn fuel credential stuffing and DDoS botnets. Removing X.CPE contributes to overall protection in this space and helps safeguard unsuspecting consumers harmed by this scheme."
Research and Resources:
- Google: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet
- Plume: http://www.plume.com/xcpe-botnet-whitepaper-pdf
- TrendAI™: https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/trendaitm-research-helps-disrupt-android-tv-botnet-of-more-than-13-million-pre-infected-devices
About Plume
About TrendAI™
TrendAI™, a global AI security leader and enterprise business unit under Trend Micro, helps organizations achieve comprehensive AI visibility, governance, and integrated security to build confidence, drive innovation, and eliminate risk. Trusted by large enterprises and government institutions in 185 countries, TrendAI™ protects the entire organization—from identity to infrastructure to data. Fortune 500 companies rely on TrendAI™ to block threats up to 115 days earlier using the world’s leading threat and attack intelligence. For more information, visit trendaisecurity.com.
About Lumen
Lumen Technologies connects people to data and applications through its network and technology services. Its Black Lotus Labs threat research and operations team leverages global network visibility to identify malicious activity, generate threat intelligence, and help protect enterprises and the internet. For more information, visit Lumen Technologies.
About HUMAN Security
Human Security helps organizations protect digital experiences by detecting and blocking automated threats, fraud, and abuse. Its technology and threat intelligence enable businesses and platforms to verify digital interactions and build trust throughout the customer journey. Learn more at humansecurity.com.
About Synthient
Synthient provides intelligence to identify residential proxies, VPNs, and botnet infrastructure, helping organizations assess traffic risk and investigate abuse. Its researchers analyze proxy networks, botnets, and adversary infrastructure to uncover emerging threats. Learn more at Synthient.