TrendAI Takes Down X.CPE Botnet in Set-Top Boxes
A coordinated international operation disrupted a botnet hidden in more than 1.3 million set-top boxes across more than 200 countries.
Updated on Nov. 5, 2026 in Cybersecurity
Live Poll
Do you trust the streaming devices in your home to be free of hidden threats?
TrendAI announced a coordinated takedown of X.CPE, a global botnet embedded in set-top box firmware before devices reached subscribers' homes. The operation was led by TrendAI, Google, Plume, Lumen, HUMAN Security, Synthient, and Japan's National Police Agency.
Why it matters
Subscribers received no consent request, notification, or opt-out option, leaving compromised devices exposed to remote access and data collection. The botnet was built to evade pre-release security checks, highlighting weaknesses in how device firmware is vetted before reaching consumers.
X.CPE was embedded in device firmware, the software controlling basic device operations, and used residential proxy software to route third-party traffic through subscribers' internet connections. Researchers documented collection of device, network, and account information alongside persistent remote access capabilities.
The players
TrendAI
TrendAI is a cybersecurity company whose research arm led the coordinated takedown of the X.CPE botnet.
Google is a technology company that led the takedown effort and banned the responsible device manufacturer from preloading Google apps on future devices.
Japan's National Police Agency
Japan's National Police Agency is the national law enforcement body of Japan that partnered in the takedown of the X.CPE botnet.
The details
Google banned the responsible OEM and future subsidiaries from making devices with preloaded Google apps. The takedown disrupted the command-and-control domains that operate the criminal affiliates' malware modules, and TrendAI Research will monitor the attackers closely if they attempt to rebuild.
Timeline
November 5, 2026: TrendAI announced the coordinated takedown of X.CPE.
Tech Race
The X.CPE case shows residential proxy abuse moving upstream into firmware supply chains, where malware is embedded before devices reach consumers. Google's ban on the responsible OEM marks a platform-level enforcement response to that supply-chain vector.
Owners of affected set-top boxes may have devices that remain compromised until the infrastructure is fully severed. Subscribers should check whether their device has been flagged by their provider and monitor their connection for unexpected activity.
The takeaway
Device firmware and the supply chain that delivers it are now a primary security boundary for home networks. Consumers should prefer providers that disclose firmware update practices and offer clear consent for any shared network use.
Further reading
Explore more Cybersecurity coverage for context on botnets and device security threats.
Live Poll
Do you trust the streaming devices in your home to be free of hidden threats?
