How the Operation Worked
A joint law enforcement and industry operation has disrupted NetNut, a residential proxy network that controlled at least two million infected Android devices globally. The botnet, also known as Popa, relied on compromised smart TVs, streaming boxes, and mobile phones to route malicious traffic through legitimate home internet addresses. Google Threat Intelligence Group, the FBI, Lumen Technologies, and The Shadowserver Foundation participated in the takedown, which included seizing domains used by the service and disabling backend command-and-control infrastructure.
Google took additional action by using Play Protect to automatically warn users and disable infected applications. The company also shared technical details about the botnet’s software development kits and C2 servers with platform providers and cybersecurity researchers. These steps effectively cut off the operators’ access to the infrastructure needed to control their network of compromised devices.
Impact and Scope
NetNut was one of the largest residential proxy networks in the world, used by hundreds of threat actors including cybercriminal and espionage groups. Google reported observing 316 distinct threat clusters using NetNut exit nodes in a single week last month. Attackers leveraged the service to access their own infrastructure, conduct password-spraying attacks, and reach victim environments. The disruption is expected to have broader effects across the proxy industry due to NetNut’s extensive reseller program, which allowed other services to white-label its network capacity.
The takedown represents an ongoing effort by Google to dismantle residential proxy botnets, following a similar action against IPIDEA earlier this year. Mandiant noted that disrupting one proxy service often drives operators to purchase replacement capacity from competing providers, highlighting the deeply interconnected nature of the proxy industry.
Source: BleepingComputer
