Google, TrendAI™, Plume, Lumen, HUMAN Security and Synthient have taken down a botnet that was hidden inside more than 1.3 million TV set-top boxes across over 200 countries, working alongside Japan’s National Police Agency.

Malware built into the hardware, not downloaded onto it

The botnet, called X.CPE, didn’t need anyone to click a bad link or install a dodgy app. It was embedded in the firmware of TV set-top boxes before they were ever sold, giving its operators remote access to the devices and the home broadband connections behind them, without the subscriber ever agreeing to it.

Google says X.CPE was built specifically to slip past pre-release security checks. In response, it has updated its own review process and banned the original equipment manufacturer behind the devices, along with any future subsidiaries, from building hardware preloaded with Google apps.

What the boxes were actually doing

Once compromised, the set-top boxes were quietly put to work: reselling their owners’ bandwidth, running ad fraud, loading further backdoors and, in earlier versions of the malware, installing paid apps without consent. Researchers also found the devices collecting network and account information while keeping persistent remote access open.

“Our research identified over 1.3 million devices affected by this campaign. That’s millions of households and businesses completely unaware that their equipment was being used as an accessory in active criminality,” said Robert McArdle, Director of Cybercrime Research at TrendAI™.

Google assesses that beyond the 1.3 million infected set-top boxes, dismantling the campaign’s command-and-control domains will also cut off access to at least 10 million additional devices compromised through the same criminal affiliates’ other malware.

A supply chain problem, not a user error

For internet service providers, the case is a reminder that a device can look like it’s working fine and still be generating traffic nobody asked for. Plume, which contributed broadband intelligence to the investigation, framed it as a visibility gap rather than a subscriber mistake.

“Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect,” said Chris Griffiths, Chief Technology Officer at Plume.

Lumen, HUMAN Security and Synthient each contributed a different piece of the picture, network visibility, digital fraud detection and proxy-infrastructure analysis, to trace how the botnet monetised its access.

“Compromised-device networks are sustained by profit: operators take control of devices and household connections without consent, then monetise that access through proxy services and various fraud activities,” said Gavin Reid, CISO at HUMAN.

What happens next

TrendAI™ says it will keep watching for signs the operators try to rebuild the network. For now, the takedown stands as one of the larger coordinated actions this year against malware baked into consumer hardware rather than installed after the fact, a distinction that matters for anyone trying to work out whose job it was to catch it.