Synthient

Google Dismantles XCPE Botnet Infecting 1.3 Million Android TV Boxes for Residential Proxy Fraud

Google Threat Intelligence Group collaborated with industry partners to dismantle the XCPE botnet, which had enrolled more than 1.3 million Android TV set-top boxes manufactured by Videostrong Technology Co. The malware secretly turned user devices into residential proxies sold to criminal actors for advertising fraud, account takeovers, and content scraping. The operation is expected to disrupt access to at least 10 million additional compromised IoT devices, including healthcare equipment and karaoke machines. Multiple residential proxy providers such as Honeygain, NetNut, and Grass were linked to the campaign through their SDKs. The takedown also highlighted supply-chain risks in Android-based IoT manufacturing and the role of influencer marketing in distributing pre-infected devices.

Residential Proxies Found Exiting from White House Network AS2650

Security researchers at Layer3 Intel detected multiple residential proxy nodes operating from the Executive Office of the President network AS2650 between October 5 and November 3. The activity involved at least six IP addresses and 236 proxy exits, primarily during evening hours, with 28 different residential proxy services routing traffic through the network. Synthient linked much of the traffic to Infatica proxy software installed on Windows 11 devices, a service founded by Russian national Vladimir Fomenko whose earlier company King Servers hosted infrastructure used in 2016 election system intrusions in Arizona and Illinois. Experts warn that such proxies enable low-cost anonymous access to sensitive government networks, with documented cases of criminals exploiting proxy service vulnerabilities to scan internal systems for malware deployment. Similar proxy activity has been observed across hundreds of government, utility, healthcare, and financial networks according to recent industry reports from Spur and Infoblox.