Summary
The FBI, in partnership with Google’s Threat Intelligence Group and other industry partners, has successfully disrupted NetNut, one of the world’s largest commercial residential proxy networks. Also tracked as the “Popa” botnet, NetNut had quietly co-opted over two million consumer devices worldwide — primarily inexpensive Android-based smart TVs, streaming boxes, and devices running unofficial apps — turning them into traffic-routing relays for cybercriminals.
NetNut operated by embedding deceptive software development kits (SDKs) into consumer device firmware and apps. Once installed, victims’ home internet connections were silently used as proxy exit nodes, allowing malicious traffic to bypass data center blocks and blend in with legitimate residential traffic. Google reported that in a single week in June 2026, at least 316 distinct threat clusters used NetNut exit nodes for password-spraying, credential stuffing, ad fraud, and data scraping operations.
The takedown included seizure of hundreds of associated domains, disabling of Google accounts used for malware command-and-control, updates to Google Play Protect, and removal of compromised apps. The network’s operator has been linked to Alarum Technologies Ltd, a publicly traded Israeli company. This operation follows the January 2026 disruption of the IPIDEA proxy network, signaling sustained law enforcement pressure on the residential proxy ecosystem.
Source
SecurityWeek — Google, FBI Disrupt NetNut Residential Proxy Network
Krebs on Security — FBI Seizes NetNut Proxy Platform, Popa Botnet
Commentary
The residential proxy problem is one of cybersecurity’s most underappreciated enablers. By routing malicious traffic through millions of real home IP addresses, services like NetNut make it nearly impossible for defenders to distinguish between legitimate and malicious traffic using IP reputation alone. The 316 threat clusters using the network in a single week speaks volumes about how integral these services are to modern cybercrime operations.
The link to a publicly traded company is particularly notable — this was not some shadowy underground operation but a commercially marketed service with corporate backing. Expect this takedown to force remaining residential proxy operators to reconsider their business models, though the demand from threat actors virtually guarantees new services will fill the vacuum.