XCPE Botnet Takedown: 1.3 Million TV Boxes Were Infected Before You Unboxed Them

Another takedown, another press release. This week Google and a coalition of industry partners announced they had severed the command-and-control infrastructure behind XCPE, a botnet of more than 1.3 million Android TV set-top boxes that left the factory with malware baked into the firmware. The devices rented their owners' bandwidth to residential proxy customers and quietly burned through ad fraud payloads in the background. Google says the operation also cut the operators off from an estimated 10 million additional compromised devices — telehealth terminals, karaoke machines, digital signage. Impressive numbers. We have seen this movie before.

Firmware-level persistence changes the math

Most of the fleets we deal with are opportunistic: recruited through an unpatched CVE, a default telnet password, a router nobody rebooted since 2019. Patch the hole and the herd thins out. XCPE never needed a hole. Videostrong, the manufacturer Google named, loaded the malicious module immediately after first boot, before the owner had a chance to install anything, and it slipped past Android's own compatibility and security testing. That is a supply-chain infection shipped inside a signed-off build, and it is the most durable distribution model we have seen at this scale.

Consider what that does to remediation. A device compromised before it reaches the customer will not be rescued by a vendor update from the company that shipped the backdoor. Owners of these boxes do not know they are running a node, do not patch them, and in most cases never will. The infection is permanent until the hardware dies.

The takedown severed reach, not infection

Sinkholing the C2 is a genuine win, and we say that as people who make life difficult for sinkholes. But the 1.3 million boxes are still sitting on residential networks, still running the implant, still beaconing into the void. The operators lost their control plane; they did not lose their army. Abandoned infrastructure gets adopted — sometimes within weeks — by whoever buys the expired domains, reverse-engineers the protocol, or simply inherits the affiliate relationships. Fleets change hands faster than the vendors who built them can publish a report.

The estimate of 10 million additional compromised devices shows how deep the affiliate model ran. Each proxy and ad fraud partner pushed its own modules through its own channels, so the takedown removed one distributor, not the distribution network.

Proxyware is the perfect cover for a DDoS fleet

Here is the part that matters to us. Residential proxy revenue — renting bandwidth by the gigabyte, plus ad fraud impressions — is low-risk, recurring, and looks entirely legitimate on an invoice. It keeps a fleet warm, funded, and geographically distributed between attack jobs. When a customer needs a layer 7 push, an http flood that resembles real user traffic, or a cloudflare bypass that walks straight through a js challenge, a million residential IPs across a hundred countries is exactly the asset you want. The same pool powers account takeover, scraping, and the udp flood and tcp handshake flood traffic that keeps ip stresser and booter operators in business.

That is why the monetization layer is more dangerous than the attack layer. A botnet that only speaks attack traffic burns bright and gets mitigated. A botnet with a revenue model pays its own hosting bills and hides in plain sight as a "residential network" that ddos protection vendors happily whitelist.

What we take from this

Synthient's earlier work on Kimwolf proved the point: documenting proxy infrastructure and forcing providers to patch fragmented that botnet and made its record-smashing attacks manageable for network operators. Visibility degrades fleets. Takedowns make headlines. The 1.3 million infected boxes will be re-recruited, and the next operator inherits a ready-made pool of clean residential addresses for stress testing someone else's edge.

If you want to know how your own stack behaves against residential-sourced layer 7 traffic, stop guessing. Our free stress test is live at /contact — pick a target, pick a vector, and see what your scrubbing actually absorbs. Past results are on /achievements; the source report is at Krebs on Security, with Synthient's device breakdown at synthient.com.