The X.CPE Botnet

From Device Management to Monetization Framework

Publish date:November 2, 2026

Overview

A subscriber buys an inexpensive streaming box and connects it to their home network. Hidden in its firmware is a backdoor that can give attackers control of the device.

Plume Security Labs investigated X.CPE, a botnet that compromised more than 1.3 million devices worldwide. The research traces how compromised 3rd-party set-top boxes became infrastructure for residential proxy services and other unauthorized activity.

Developed in collaboration with Google and other industry security partners, the paper documents the botnet’s operation, evolution and eventual disruption by Plume and Google.

Download the full research paper.

Whitepaper

Gergely Eberhardt

Senior Security Researcher

Gergely Eberhardt is a Security Researcher at Plume with deep expertise in ethical hacking, vulnerability research and CRAs. His work spans security evaluation and threat analysis across connected devices and networks, with a focus on identifying and addressing emerging security challenges in IoT environments.

Robert Neumann

VP, Plume Security Labs

Robert Neumann is the Vice President of Security Labs at Plume. Besides managing teams to counterbalance the fight against cybercriminals, he is focusing on various short- and long-term research projects, ranging from small scale malicious campaigns through niche malware and file formats to in-depth investigations and threat actor attribution.