If you missed this Google announcement yesterday:
Google: Shutting the Door on the XCPE Botnet https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet
More:
KrebsonSecurity: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/ @briankrebs@infosec.exchange #Google #botnet #infosec #Android #threatintel #threatintelligence
@AAKL@infosec.exchange @briankrebs@infosec.exchange So, they take out the C&C domain name. Did they also take out any remote update servers baked into the firmware? Did they also somehow prevent them from selling even more new TV boxes with a different C&C domain name or that use alternate name resolution?
Did Google manage to offer alternative, malware-free firmware replacement for existing boxes or are they now bricked or abandonware?
@AAKL@infosec.exchange @briankrebs@infosec.exchange
Great threat-intel write-up. Lots of detail on the malware ecosystem and how the operators monetized infected devices.
The only thing I was missing was which domains/IPs were actually disrupted (or seized) and maybe a few log-search regexes 😉
We still have stuff to do, as those IP addresses, for example, are definitely not on all the null0 route/blocklists yet (see screenshot).
Also found this very detailed report on the X.CPE ecosystem by Plume: https://cdn.plume.com/3d/92/f7c576bd4afabd79df4e7b39ca7f/xcpe-botnet-whitepaper-10-2026.pdf
@AAKL@infosec.exchange @briankrebs@infosec.exchange That Google is explicitly calling for more accountability of resellers and marketplaces seems spicy considering their long-standing position that they should not be held accountable for malvertisement campaigns on Google's ad networks