A coordinated industry operation led by Google, Plume, TrendAI, Lumen, HUMAN Security and Synthient, alongside Japan’s National Police Agency, has disrupted X.CPE, a botnet embedded in more than 1.3 million set-top boxes across over 200 countries. The operation highlights how compromised connected devices can become part of criminal infrastructure used for residential proxy services, advertising fraud and other forms of malicious activity.
The botnet was reportedly installed in device firmware before the set-top boxes reached consumers. This meant subscribers did not need to download malicious software or interact with suspicious links to become part of the network. Their devices and home broadband connections were being used without their knowledge or consent.
For the advertising industry, the case illustrates a persistent challenge: residential internet connections can be exploited to make automated or fraudulent activity appear to originate from legitimate household networks.
Residential Proxies Create Advertising Integrity Risks
According to the partners, X.CPE monetized compromised devices through several methods, including reselling residential bandwidth, delivering video content, committing ad fraud, installing additional backdoors and, in earlier versions, installing applications for payment.
Residential proxy services route third-party internet traffic through the IP addresses and connections of compromised household devices. Because that traffic originates from residential networks, it can complicate efforts to distinguish legitimate users from automated or malicious activity.
In advertising, this creates risks for traffic validation, campaign measurement and fraud detection. Residential proxy infrastructure can help malicious operators obscure the origin of automated activity, potentially undermining systems used to evaluate impressions, clicks and other campaign interactions.
The partners also identified collection of device, network and account information, alongside persistent remote-access capabilities. These functions extend the threat beyond advertising fraud to subscriber privacy, network security and the integrity of connected-device supply chains.
Coordinated Disruption Targets Botnet Infrastructure
The operation combined expertise in connected-device security, malware research, broadband network visibility and digital fraud detection. The partners worked to analyze X.CPE and disrupt its operations, including the command-and-control domains used to operate criminal affiliates’ malware modules.
Google said the disruption of those domains could sever access to at least 10 million additional compromised devices. That figure represents potential disruption of access through the affected infrastructure, not a confirmed count of additional X.CPE-infected set-top boxes.
Google also said it updated its device review process after identifying how X.CPE evaded pre-release security checks. The company banned the responsible original equipment manufacturer, along with future subsidiaries and affiliates, from making devices with preloaded Google apps.
The action underscores the importance of firmware security and supply-chain controls. Unlike malware introduced through user behavior, preinstalled threats can reach consumers before devices enter normal retail and distribution channels.
Implications for Advertisers, Publishers and AdTech Platforms
For advertisers and agencies, compromised residential networks can weaken confidence in traffic sources and create additional pressure on verification systems. Publishers and advertising platforms also face risks when fraudulent activity is routed through connections that appear to be associated with real households.
Ad verification providers and fraud-prevention companies may need to combine device intelligence, network-level signals and behavioral analysis to identify suspicious traffic patterns. The operation also demonstrates why fraud prevention cannot rely exclusively on signals collected within advertising platforms.
HUMAN Security and Synthient highlighted the connection between compromised-device networks, illicit pay-per-install distribution, proxy services and broader fraud activity. These networks can support multiple forms of abuse, making infrastructure disruption relevant beyond the initial botnet.
Market Landscape
The incident reflects the overlap between connected-device security and digital advertising integrity. Smart TVs, set-top boxes and other consumer devices increasingly operate as network-connected endpoints, creating opportunities for attackers when firmware and distribution controls are insufficient.
For the AdTech ecosystem, the concern is not limited to whether an impression or click is fraudulent. The underlying network infrastructure can also be compromised, allowing criminal operators to monetize household bandwidth and use residential identities to disguise malicious traffic.
Strategic Outlook
The X.CPE disruption demonstrates the value of cooperation between technology providers, security researchers, broadband specialists and law enforcement. No single organization necessarily has visibility across device firmware, network behavior, malware infrastructure and advertising fraud signals.
For the advertising industry, the next challenge is translating such disruption into stronger, ongoing defenses. Device provenance, firmware review, residential proxy detection and independent traffic validation will remain important areas for platforms seeking to protect campaign integrity.
The takedown does not establish that residential proxy abuse or ad fraud associated with compromised devices has been eliminated. It does show how coordinated intelligence sharing can disrupt infrastructure supporting several connected forms of digital crime.
Top Insights
- X.CPE was embedded in firmware on more than 1.3 million set-top boxes across over 200 countries.
- The botnet monetized compromised household connections through residential proxies, video delivery and ad fraud.
- The operation disrupted command-and-control domains associated with the malware network.
- Google estimates the domain disruption could sever access to at least 10 million additional compromised devices.
- The case highlights the connection between connected-device security, residential proxy abuse and advertising fraud.
Get in touch with our Adtech experts
