Google leads takedown of botnet hidden in 1.3 million TV boxes

A coalition that includes Google, Plume, TrendAI, Lumen, HUMAN Security and Synthient — together with Japan’s National Police Agency — dismantled X.CPE, a botnet embedded in the firmware of upward of 1.3 million TV set-top boxes in upward of 200 countries before the devices ever reached a store shelf. Because the malware shipped as part of the hardware itself, subscribers got no consent request, notification or opt-out, unlike infections that require someone to open an attachment or install an app.

The botnet turned compromised home broadband connections into a business, the partners said: it resold bandwidth, served video content, ran ad fraud, added backdoors and — in earlier versions — pushed paid app installs onto devices, all without owners’ knowledge. The takedown also disrupted command-and-control infrastructure tied to the criminal affiliates who distributed the malware’s fraud modules; because those affiliates spread their tools through other channels too, Google estimates that shutting down those domains will cut off at least 10 million more compromised devices from the operators’ reach.

X.CPE was designed to evade pre-release security checks before reaching subscribers, prompting Google to update its review process and ban the responsible device maker, along with any future subsidiaries or affiliates, from building devices preloaded with Google apps. “Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” said Google Threat Intelligence Group disruption-operations lead Charley Snyder. “Disrupting X.CPE took partners across industry working together. It’s proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries.”

Why it matters

The case shows how supply-chain compromise can hide inside hardware that looks and performs normally, turning a streaming box bought in good faith into unpaid infrastructure for fraud and residential proxy abuse at a scale that only cross-industry, cross-border cooperation could unwind.