Reported by 1 outlet
Google, FBI Disrupt NetNut Residential Proxy Network — 2 Million Compromised Devices Used for Cybercriminal and State-Sponsored Attacks
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Google, FBI Disrupt NetNut Residential Proxy Network — 2 Million Compromised Devices Used for Cybercriminal and State-Sponsored Attacks
securityweek.com · 103d ago · July 3rd, 2026
Google, the FBI, and international partners coordinated a takedown of NetNut (also known as Popa), a massive residential proxy network consisting of more than 2 million Android devices — smart TVs, streaming boxes, and other IoT devices — infected through trojanized applications and malware including Badbox 2.0. The network's operator, linked to publicly-traded Israeli firm Alarum Technologies Ltd, rented access to these compromised devices to cybercriminal and espionage groups to mask their identities during attacks.
In a single week in June, Google observed 316 distinct threat clusters using NetNut to hide their locations in password-spray attacks and to access victim environments. The takedown disabled Google accounts and associated services used for command-and-control, dismantled the botnet's backend, disabled infected applications via Google Play Protect, and automatically warned victims. Google also operates a reseller program, allowing other brands to whitelabel the NetNut botnet.
"This follows the January disruption of IPIDEA and is expected to have a ripple effect across the ecosystem," Google noted, adding that "when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors."