Google and Partners Disrupt Proxy Botnet Tied to 1.3M TV Set-Tops, 10M Systems

Key points

• Google and industry partners dismantled a botnet in November 2026.
• The operation severed access and disrupted a proxy network.
• 1.3 million Android TV set-tops and ten million other systems were involved.
• Affected equipment included IoT, healthcare, and karaoke devices.
• No CVE was cited for this action.

In November 2026, Google and a group of industry partners carried out a coordinated takedown of a botnet. The operation severed the operators’ access and disrupted a proxy network, ending the infrastructure’s ability to route traffic through compromised devices.

The scope was large: 1.3 million Android TV set-top units were involved, along with ten million other systems. The affected estate included internet-of-things equipment, healthcare devices, and karaoke machines, showing how broadly embedded and consumer hardware can be conscripted into criminal infrastructure.

For K-12 and government networks, the case is a reminder that unmanaged endpoints and building systems can become part of someone else’s attack platform even when they are not traditional computers. Healthcare devices raise additional safety and privacy concerns, while TV boxes and karaoke machines often sit outside standard patching and monitoring.

Google’s work with industry partners matters because botnet and proxy operations rarely depend on a single vendor or network. Coordinated action can remove access, but device owners still need to identify exposed hardware, replace or update unsupported units, and watch for unusual outbound traffic. No CVE was associated with this action, so signature-based vulnerability tracking alone would not have surfaced it.

Watch for follow-up reporting on how the ten million other systems were affected, whether device makers issue firmware guidance, and whether any compromised devices remain reachable. Organizations should treat consumer-grade and specialty devices as part of the attack surface, not as exceptions.

What to do now

1. Inventory every Android TV set-top, IoT, healthcare, and karaoke device on your network; record owner, model, firmware, and support status.
2. Place these devices on isolated VLANs or firewall zones and restrict outbound traffic to only the destinations they need.
3. Apply available firmware updates, disable unused remote-access and management services, and replace end-of-support units.
4. Change default credentials, rotate device admin passwords, and limit management interfaces to trusted admin networks.
5. Monitor DNS and outbound connections for unexpected proxy-like behavior from media, IoT, and clinical devices; alert on anomalies.
6. For healthcare equipment, coordinate changes with clinical engineering and vendors, and use compensating controls where patching is not possible.
7. Preserve logs and review for signs of botnet or proxy participation; report suspected compromises to your security team.

Original source

Krebs on Security