Google-led operation involving TrendAI, Plume, Lumen, HUMAN Security, Synthient and Japan’s National Police Agency disrupts a global network exploiting home broadband connections without users’ knowledge.
A coordinated industry and law-enforcement operation has disrupted X.CPE, a global botnet embedded in more than 1.3 million TV set-top boxes across over 200 countries. The devices were compromised through pre-installed firmware before reaching consumers, allowing cybercriminals to exploit household internet connections without subscribers’ knowledge or consent.
The operation was led by Google, Plume, TrendAI™, Lumen, HUMAN Security and Synthient, alongside Japan’s National Police Agency. TrendAI research identified more than 1.3 million affected devices, while the partners combined malware analysis, threat intelligence and network visibility to disrupt the botnet’s infrastructure.
“Millions of households and businesses were completely unaware that their equipment was being used as an accessory in active criminality.”
— Robert McArdle, Director of Cybercrime Research, TrendAI
X.CPE enabled several criminal revenue streams, including bandwidth resale, residential proxy services, advertising fraud, video content delivery and the installation of additional backdoors. Its residential proxy software allowed third-party traffic to pass through victims’ home IP addresses, potentially enabling activities such as credential theft, identity impersonation and other attacks that exploit the apparent geographic location of subscribers.
The takedown also targeted command-and-control domains used to operate the botnet’s malware modules. Google estimates that disrupting these domains will sever access to at least 10 million additional compromised devices. Google has also updated its device review process and banned the responsible original equipment manufacturer, including future subsidiaries and affiliates, from producing devices with preloaded Google apps.
“Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect,” said Chris Griffiths, Chief Technology Officer at Plume.
Robert McArdle, Director of Cybercrime Research at TrendAI, said the action significantly sets back the attackers, adding that TrendAI will continue monitoring their attempts to rebuild.
The incident highlights a critical supply-chain security risk: connected devices can appear to function normally while secretly turning household networks into infrastructure for criminal activity.