Google, Plume, TrendAI ™, Lumen, HUMAN Security, Synthient, and the National Police Agency of Japan have formed a coordinated effort to identify and combat X.CPE botnets, combining security research, threat intelligence, and cyber expertise.
Mountain View, California, USA, November 2, 2026 / PRNewswire / -- Today, a group of partners from both the private and public sectors announced that they have coordinated the removal of X.CPE. This is a global botnet that was hidden in over 1.3 million set-top boxes across more than 200 countries. The malware was implanted before the devices were sold and operated using the devices and home internet connections of subscribed users without their knowledge or consent. This removal effort was led by Google, Plume, TrendAI ™, Lumen, HUMAN Security, and Synthient, and involved the participation of the National Police Agency of Japan.
The head of Google's Threat Intelligence Group operations, Charley Snyder, stated: "Such actions increase the cost for criminals and also demonstrate that the infrastructure they rely on is not untouchable. Eliminating X.CPE requires collaboration among industry partners. This proves that cooperation is one of our most powerful tools in dealing with threats that cross borders and industries."
A familiar device, hiding a strange threat
X.CPE is embedded in the firmware, which is the software that controls the basic operation of the device, and it is implanted before the set-top box arrives at the subscriber's home. X.CPE was designed to circumvent pre-market security checks. Google has since updated its review process in light of this, and has prohibited related original equipment manufacturers (OEM) and any future subsidiaries or affiliated companies from producing devices pre-installed with Google apps. Unlike infections that rely on users opening suspicious attachments or installing apps, this threat comes as part of the device itself. Subscribers did not receive consent requests, notifications, or options to opt out.
With the cooperation of the National Police Agency of Japan, Google, Plume, TrendAI ™, Lumen, HUMAN Security, and Synthient launched a coordinated crackdown on X.CPE. Each organization leveraged its expertise in network device security, malware analysis, network visibility, and digital fraud detection to analyze and disrupt the operations of this botnet.
These organizations jointly eliminated a threat hidden behind what appeared to be ordinary device activities: software embedded in television set-top boxes provided remote access for botnet controllers, allowing them to utilize home broadband connections without the consent of subscribed users. This cleanup action also disrupted the command and control domains that operated malware modules associated with criminal entities. Since these entities also distributed their modules through channels other than X.CPE, Google believes that shutting down these domains will cut off access for at least an additional 10 million infected devices.
This action demonstrates that connecting cross-organizational intelligence is crucial for addressing threats that transcend technical and network boundaries. Partners brought together different perspectives on infected devices, malware, and internet traffic, supporting this coordinated cleanup effort aimed at disrupting unauthorized access and monetization activities, as well as mitigating the risks to the privacy of subscribed users, broadband resources, and the trust placed in connected devices.
Turning home broadband into a business without permission
This botnet generates revenue from infected devices in various ways, including reselling bandwidth, transmitting video content, engaging in ad fraud, loading additional backdoors, and installing paid applications in earlier versions.
For service providers, these findings highlight supply chain risks that may not be apparent from the daily performance of devices. A streaming box that is functioning normally can still generate unexplained traffic, which can undermine people's trust in broadband services.
Complementary professional capabilities, coordinated actions
Partners provided support for the Google-led X.CPE cleanup operation:
- TrendAI ™TrendAI ™, Director of Cybercrime Research, stated: "We appreciate Google's decisive action in eliminating this threat. Our research identified that over 1.3 million devices were affected by this campaign. This means that millions of households and businesses were completely unaware that their devices were being used as an adjunct to active criminal activities—whether it was to deceive advertisers or to carry out other attacks by leveraging their connections through residential proxies, which often also included identity theft by impersonating people in their regions. The actions taken by Google and its research partners have significantly slowed down these attackers, and if they attempt to rebuild, our TrendAI research will continue to closely monitor them."
- HUMANHUMAN Chief Information Security Officer Gavin Reid stated: "The reason why infected device networks are able to sustain themselves is due to profit: operators control devices and home connections without consent, and then monetize this access through proxy services and various fraudulent activities. As this operation demonstrates, collective action can cut off the infrastructure needed to monetize these networks, increase the cost of operating them, and weaken the incentives that support them."
- SynthientSynthient CEO Benjamin Brundage stated: "Illegally paid-for installation networks provide a crucial pillar for larger fraud ecosystems, facilitating various activities ranging from direct advertising fraud to unregulated proxy networks, which in turn promote credential stuffing and DDoS zombie networks. Eliminating X.CPE contributes to the overall protection of this industry and also helps to safeguard consumers who are unknowingly affected by such schemes."
Research and Resources:
- Google : https :// cloud.google.com / blog / topics / threat-intelligence / shutting-the-door-on-the-xcpe-botnet
- Plume : http :// www.plume.com / xcpe-botnet-whitepaper-pdf
- TrendAI ™: https :// www.trendaisecurity.com / en-us / resources-insights / trendai-security-blog / trendaitm-research-helps-disrupt-android-tv-botnet-of-more-than-13-million-pre-infected-devices
About Plume
About TrendAI ™
TrendAI™ is a global AI security leader and enterprise business unit under Trend Micro, helping organizations achieve comprehensive AI visibility, governance, and integrated security to enhance confidence, drive innovation, and eliminate risks. TrendAI™ is trusted by large enterprises and government agencies in 185 countries, providing protection for entire organizations, from identities to infrastructure to data. Fortune Global 500 companies rely on TrendAI™ to stop threats up to 115 days in advance, leveraging world-leading threat and attack intelligence. For more information, please visit trendaisecurity.com.
About Lumen
Lumen Technologies connects people with data and applications through its networks and technical services. Its Black Lotus Labs Threat Research and Operations team utilizes global network visibility to identify malicious activities, generate threat intelligence, and helps protect businesses and the internet. For more information, please visit Lumen Technologies.
About HUMAN Security
HUMAN Security helps organizations protect the digital experience by detecting and blocking automated threats, fraud, and abuse. Its technology and threat intelligence assist businesses and platforms in verifying digital interactions and building trust throughout the customer journey. For more information, please visit humansecurity.com.
About Synthient
Synthient provides intelligence for identifying residential proxies, VPN, and botnet infrastructure, helping organizations assess traffic risks and investigate abuse behaviors. Its researchers analyze proxy networks, botnets, and adversary infrastructure to reveal emerging threats. For more information, please visit Synthient.
