Industry Takedown of Botnet Hidden in More Than 1.3 Million TV Set

Google, Plume, TrendAI™, Lumen, HUMAN Security, Synthient and Japan's National Police Agency form coordinated effort combining security research, threat intelligence and network expertise to identify and disrupt X.CPE botnet

"Operations like this raise the cost for criminals and show that the infrastructure they rely on isn't out of reach," said Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group . "Disrupting X.CPE took partners across industry working together. It's proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries."

A familiar device hiding an unfamiliar threat

Google, Plume, TrendAI™, Lumen, HUMAN Security, Synthient, working with Japan's National Police Agency, carried out a coordinated disruption campaign against X.CPE. Each organization contributed in its own way, applying its expertise in connected-device security, malware analysis, network visibility and digital fraud to analyze the botnet and disrupt its operations.

Turning broadband into a business without permission

The botnet generated revenue from compromised devices in a variety of ways, including: reselling bandwidth, delivering video content, ad fraud , loading additional backdoors and, in earlier versions, installing apps for payment.

For service providers, the findings highlight a supply chain risk that may not be apparent from a device's everyday performance. A functioning streaming box can still generate unexplained traffic and undermine trust in the broadband service.

Complementary expertise, coordinated action

The partners contributed to the Google-led effort to disrupt X.CPE:

TrendAI™ Robert McArdle, Director of Cybercrime Research at TrendAI™ "We applaud Google's decisive action in removing this threat. Our research identified over 1.3 million devices affected by this campaign. That's millions of households and businesses completely unaware that their equipment was being used as an accessory in active criminality - whether defrauding advertisers or piggybacking on their connections to carry out other attacks via residential proxies - which would commonly include identity theft impersonating people in their region. This action by Google and research partners significantly sets back these attackers, and TrendAI research will be watching them closely if they attempt to rebuild."

HUMAN Gavin Reid, CISO at HUMAN "Compromised-device networks are sustained by profit: operators take control of devices and household connections without consent, then monetise that access through proxy services and various fraud activities. Group action, as exemplified in this operation, interrupts the infrastructure needed for monetisation, raising the cost of operating these networks and weakening the incentives that sustain them. "

SYNTHIENT Benjamin Brundage, CEO at Synthient. "Illicit pay-per-install networks provide a significant backbone to the larger fraud ecosystem, powering everything from direct ad fraud to unregulated proxy networks that push credential stuffing and DDoS botnets. The takedown of X.Cpe helps protect this space as a whole, as well as the unsuspecting consumers victimized by this scheme." - Benjamin Brundage

Research and resources:

Google: Plume: TrendAI™ :

TrendAI™, the global AI security leader and enterprise business unit of Trend Micro, empowers organizations with full AI visibility, governance, and consolidated security that inspires confidence, drive innovation, and eliminate risk. Trusted by the largest enterprises and governments across 185 countries, TrendAI™ secures the entire organization, from identities to infrastructure to data. Global Fortune 500 companies rely on TrendAI™ to stop threats up to 115 days earlier, powered by world-leading threat and attack intelligence. More details trendaisecurity.com .

Lumen Technologies connects people, data and applications through its network and technology services. Its Black Lotus Labs threat research and operations team uses global network visibility to identify malicious activity, generate threat intelligence and help protect businesses and the internet. More details Lumen Technologies .

HUMAN Security helps organizations protect digital experiences by detecting and disrupting automated threats, fraud and abuse. Its technology and threat intelligence help enterprises and platforms verify digital interactions and establish trust across the customer journey. More details humansecurity.com .

Synthient provides intelligence to identify residential proxies, VPNs and bot infrastructure, helping organizations assess traffic risk and investigate abuse. Its researchers analyze proxy networks, botnets and adversary infrastructure to expose emerging threats. More details Synthient .

SOURCE Plume Design, Inc.