A coalition of private and public sector partners has disrupted X.CPE, a global botnet hidden in more than 1,3-million TV set-top boxes across more than 200 countries – including South Africa.
TrendAI research identified 41 651 affected devices in South African homes between June and October 2026.
The takedown was led by Google, Plume, TrendAI, Lumen, HUMAN Security and Synthient, working alongside Japan’s National Police Agency.
Hidden in device firmware before the set-top boxes were ever sold, X.CPE used subscribers’ devices and home internet connections without their knowledge or consent, turning everyday streaming hardware into criminal infrastructure.
“We applaud Google’s decisive action in removing this threat,” says Gareth Redelinghuys, country MD of TrendAI Sub-Saharan Africa. “Our research identified over 41 000 affected devices in South Africa alone between June and October this year — meaning tens of thousands of South African households and small businesses were unknowingly turned into an accessory in active criminality, from ad fraud to identity theft carried out through their own internet connections. This action significantly sets back these attackers, and TrendAI will be watching closely for any attempt to rebuild in this region.”
X.CPE was embedded in firmware before set-top boxes reached subscribers’ homes, built specifically to evade pre-release security checks. Google has since updated its review process and banned the responsible OEM, and any future subsidiaries or affiliates, from making devices with preloaded Google apps. Unlike infections that rely on a user opening a malicious attachment, this threat arrived built into the device itself, with no consent request, notification or opt-out.
Each partner contributed its own expertise in connected-device security, malware analysis, network visibility and digital fraud to analyse and dismantle the botnet, including the command-and-control domains running its criminal affiliates’ malware modules. Because those affiliates distribute modules through channels beyond X.CPE, Google assesses that taking down these domains will also sever access to at least 10 million additional compromised devices worldwide.
The botnet generated revenue in multiple ways: reselling bandwidth, delivering video content, ad fraud, loading additional backdoors and, in earlier versions, installing paid apps. Residential proxy software let third-party traffic pass through subscribers’ connections using their home IP addresses and bandwidth without permission, while researchers also found persistent remote access and collection of device, network and account data.
For South African service providers and subscribers, the findings are a reminder that a device can look and perform normally while quietly undermining the security of the home network it sits on.
“Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” says Charley Snyder, head of disruption operations at Google Threat Intelligence Group. “Disrupting X.CPE took partners across industry working together — proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries.”
“Compromised-device networks are sustained by profit — operators take control of devices and household connections without consent, then monetise that access through proxy services and fraud,” says Gavin Reid, CISO at HUMAN. “Coordinated action like this interrupts the infrastructure needed for that monetisation, raising the cost of running these networks and weakening the incentives that sustain them.”