XCPE Botnet Takedown: 1.3M TV Boxes Still Infected
Google sinkholed the XCPE botnet's C2, but 1.3 million backdoored TV boxes remain infected, and their proxy revenue model makes them ideal DDoS assets.
Layer 7 (application-layer) DDoS attacks: HTTP GET/POST floods, HTTP/2 techniques, challenge bypass and real cases from Mēris — the botnet that made Layer 7 attacks a headline topic.
Google sinkholed the XCPE botnet's C2, but 1.3 million backdoored TV boxes remain infected, and their proxy revenue model makes them ideal DDoS assets.
CVE-2026-58115 turns Siemens IoT2050 gateways into persistent botnet relays via an unauthenticated Node-RED interface. Here's why edge devices recruit so well.