TrendAI helps disrupt X.CPE botnet in 1.3m devices

TrendAI has announced the takedown of the X.CPE botnet, an operation that affected more than 1.3 million Android TV set-top boxes in over 200 countries, including 34,206 devices in Australia.

The malware was embedded in device firmware before the boxes reached consumers, allowing attackers to use household internet connections without the owners' knowledge. The network turned infected devices into residential proxies, enabling malicious traffic to pass through ordinary home and office IP addresses.

This allowed threat actors to appear as local users when accessing online services. Because the traffic came from genuine residential connections, it could bypass IP reputation and geolocation checks used by banks, retailers and other digital platforms to verify users.

The disruption effort involved TrendAI, Google, Plume, Lumen, HUMAN Security, Synthient and Japan's National Police Agency. Over several months, TrendAI supplied threat intelligence on the botnet infrastructure while partners analysed the network and worked to disrupt its operation.

Australia ranked among the 10 most affected countries identified in the investigation. Researchers said thousands of households and businesses bought devices that were already compromised, with no warning, consent request or option to opt out.

Hidden in firmware

X.CPE differed from more familiar consumer malware because it did not rely on a user opening a file or installing an app. Instead, it arrived as part of the device software itself, embedded in the firmware that controls the set-top box's core functions.

TrendAI and its partners said the botnet was designed to avoid pre-release security checks. Google has since updated its review process and banned the original equipment manufacturer responsible, along with any future subsidiaries or affiliates, from making devices with preloaded Google apps.

The takedown also targeted command-and-control domains used by criminal affiliates linked to the malware. According to Google's assessment, removing those domains could cut off access to at least 10 million additional compromised devices beyond the set-top boxes directly associated with X.CPE.

The infected devices were used for several forms of online abuse, including reselling bandwidth, delivering video content, ad fraud, loading additional backdoors and, in earlier versions, installing apps for payment. Researchers also identified the collection of device, network and account information, along with persistent remote access to affected systems.

For internet service providers, the case highlights a supply chain threat that may not be visible from a device's outward performance. A streaming box can appear to function normally while generating unexplained traffic in the background and exposing broadband subscribers to misuse of their connections.

Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group, described the case as an example of cross-sector enforcement against a criminal network that relied on hidden infrastructure in consumer products.

"Operations like this raise the cost for criminals and show that the infrastructure they rely on isn't out of reach. Disrupting X.CPE took partners across industry working together. It's proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries," said Snyder.

TrendAI's findings also underline the growing exposure created by connected household devices, especially where security risks originate in manufacturing or distribution rather than user behaviour. In such cases, consumers may have little practical way of knowing that a product was compromised before purchase.

Robert McArdle, Director of Cybercrime Research at TrendAI, said the company's research identified more than 1.3 million affected devices globally, including more than 34,000 in Australia.

"We applaud Google's decisive action in removing this threat. Our research identified over 1.3 million devices affected by this campaign, including 34,206 pre-infected home devices in Australia. That's thousands of Australian households and businesses completely unaware that their devices and home internet were being used as accessories in active criminality. As the adoption of connected home solutions grows across Australia, there will be more hidden risks inside the devices used every day. This collaborative effort with Google and research partners significantly sets back these attackers, and TrendAI Research will be watching them closely if they attempt to rebuild," said McArdle.

Chris Griffiths, Chief Technology Officer at Plume, said broadband-level visibility helped uncover risks that individual subscribers would struggle to detect themselves.

"Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect. By contributing broadband intelligence to this joint effort, we helped expose hidden supply chain risks and support coordinated action to make networks safer for service providers and their subscribers," said Griffiths.