Google, FBI Disrupt NetNut Residential Proxy Botnet

Google says it acted in coordination with the FBI, Lumen and other partners to disrupt NetNut, a residential proxy network also tracked as Popa. According to Google's Threat Intelligence Group (GTIG), the operation took three main steps:

• Disabled Google accounts and services that NetNut used for malware command-and-control (C2), which Google says violated its Terms of Service and Acceptable Use Policy.
• Shared technical intelligence on NetNut's SDKs and backend C2 infrastructure with platform providers, law enforcement and research firms.
• Used Google Play Protect to warn users about, and disable, applications known to incorporate NetNut SDKs, with continued protection against future install attempts.

Google described the result as significant degradation of NetNut's network and business operations, saying the action reduced the operator's available device pool by millions. The company framed the move as a continuation of its January 2026 disruption of the IPIDEA proxy network.

Residential proxy networks sell the ability to route internet traffic through IP addresses owned by ordinary internet service providers, letting customers mask activity behind residential connections. To build that pool, operators need code running on home devices to enroll them as exit nodes - sometimes pre-installed on cheap hardware, sometimes hidden inside apps users download without understanding what they consent to.

Google estimates the NetNut network at at least 2 million devices distributed worldwide. Independent tracking cited by KrebsOnSecurity puts NetNut's daily footprint at roughly 1.5 to 2.5 million distinct IP addresses, according to Lumen's Black Lotus Labs. GTIG says Popa is associated with large-scale botnets including Badbox 2.0, and security researchers describe Popa as a plugin component tied to the Vo1d malware campaign, which targets unofficial Android-based TV boxes. Public reports cited by Google also document NetNut being used to spread variants of the Mirai DDoS malware.

In a single week during June 2026, GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes - a group that Google says spans both cybercriminal and espionage actors. According to Google, these actors used NetNut to mask their origin IP addresses when accessing victim environments, reaching their own infrastructure, and running password-spray attacks.

The risk extends into the home. When a consumer device becomes an exit node, unauthorized traffic passes through it, and Google warns that bad actors can reach other private devices on the same home network. Owners can also find their legitimate traffic flagged or blocked as their home IP is abused.

Google also stresses the ecosystem effect: beyond selling under its own brand, NetNut runs a reseller program, and Google says it has high confidence that many popular residential proxy brands are whitelabeling the NetNut botnet - one reason the company says lasting disruption requires targeting several interconnected providers at once.

The link between the Popa botnet and a named company comes primarily from investigative reporting, not Google's own advisory, and it is contested. According to KrebsOnSecurity, researchers from multiple security firms tied the Popa botnet to NetNut, a residential proxy provider owned by the publicly-traded Israeli firm Alarum Technologies Ltd (NASDAQ: ALAR). Proxy-tracking firm Synthient assessed with high confidence that devices running Popa forward traffic for NetNut clients.

Alarum Technologies rejects that framing. In a statement to KrebsOnSecurity, the company called the researchers' assertions "demonstrably inaccurate assertions and flawed deductions rather than verified facts," and disputed that its SDKs turn user devices into malware-controlled systems, saying they facilitate consent-based bandwidth sharing and that NetNut applies KYC checks and misuse monitoring. Separately, a NetNut research executive linked to one of the control domains told KrebsOnSecurity that the Popa SDK was sold and licensed to third parties years ago and that neither he nor NetNut operates the infrastructure now described as Popa. Other researchers, such as Spur, have questioned how rigorous NetNut's customer-verification really is. These competing claims should be treated as an open dispute.

Google's guidance focuses on prevention. Consumers should be wary of apps that offer payment for "unused bandwidth" or "sharing your internet," stick to official app stores, review the permissions requested by third-party VPNs and proxy apps, and keep Google Play Protect enabled. When buying connected hardware such as set-top boxes, choose reputable manufacturers and, for Android TV, confirm the device is Play Protect certified.

For IT and MSP teams, residential-proxy SDKs are also a workplace concern: reporting cited by KrebsOnSecurity notes these services frequently beacon from employee devices, and warns that if a proxy on your network is abused to attack a third party, incident responders may correctly identify your address space as the source. Consider monitoring DNS for known residential-proxy indicators, restricting untrusted streaming hardware and consumer smart-TV apps on corporate networks, and reviewing bring-your-own-device exposure.

Google cautions that point-in-time takedowns rarely end the problem. After the IPIDEA disruption, it says, individual networks proved resilient and operators simply bought capacity from competitors - effectively becoming resellers. Google says durable results require scaling enforcement across the interconnected providers that resell and whitelabel each other's pools, and it plans to keep monitoring how NetNut's peers adapt. Watch for follow-on law-enforcement actions, further researcher reporting on NetNut's recovery or migration, and any formal response or filings from Alarum Technologies.