Threat intelligence firm TrendAI said it has supported a coordinated disruption of X.CPE, a botnet it said was embedded in firmware on more than 1.3 million Android TV set-top boxes globally, including 34,206 devices identified in Australia.
According to TrendAI, the malware was present on devices before they were sold, allowing botnet operators to use subscribers’ home internet connections without their knowledge or consent. The company said Australia was among the top 10 countries where affected devices were observed.
TrendAI said the botnet was used to create “residential proxies”, enabling third-party traffic to pass through household IP addresses. The company said this can help threat actors bypass IP reputation and geolocation checks used by banks, retailers and online services to authenticate users.
The takedown was led by TrendAI, Google, Plume, Lumen, HUMAN Security and Synthient, alongside Japan’s National Police Agency, TrendAI said. TrendAI said it supplied threat intelligence on the botnet infrastructure over several months and worked with partners to disrupt command-and-control domains used to operate malware modules distributed by criminal affiliates.
Google said it has updated its review process and banned the original equipment manufacturer it said was responsible, along with any future subsidiaries or affiliates, from making devices with preloaded Google apps.
“Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach. Disrupting X.CPE took partners across industry working together. It’s proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries,” said Charley Snyder, head of disruption operations at Google Threat Intelligence Group.
Robert McArdle, director of cybercrime research at TrendAI, said the activity left device owners unaware their home internet was being used “as an accessory in active criminality”.
TrendAI said the botnet generated revenue through methods including reselling bandwidth, delivering video content, ad fraud, loading additional backdoors and, in earlier versions, installing apps for payment. It also said researchers found collection of device, network and account information alongside persistent remote access capabilities.
“Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect,” said Chris Griffiths, chief technology officer at Plume. He said the company contributed broadband intelligence to the joint effort.
The disruption highlights supply chain risks in connected consumer devices, where a device can appear to function normally while still generating unexplained traffic and exposing users and service providers to downstream fraud and privacy risks, according to the companies involved.
