Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

Summary

Google's Threat Intelligence Group, working with the FBI and others, significantly degraded NetNut (also tracked as Popa), a residential proxy network spanning approximately 2 million compromised home devices including smart TVs and streaming boxes. The network, operated by Israeli public company Alarum Technologies, allows attackers to route malicious traffic through residential internet connections to evade detection. In a single week in June, 316 distinct threat clusters including cybercriminal and espionage groups used suspected NetNut exit nodes for password-guessing attacks and other malicious activities.

Full text

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices Swati KhandelwalJul 02, 2026Cybercrime / Botnet Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people's traffic. Working with the FBI, Lumen, and others, Google's Threat Intelligence Group (GTIG) said this week it had reduced the network's pool of usable devices by millions. Google identifies NetNut, also tracked as Popa, as a network spread across home devices worldwide, including smart TVs and streaming boxes, and GTIG estimates the network holds at least 2 million devices. If one of those devices is in your home, strangers can route their own traffic through your internet connection, and your address gets the blame for whatever they do with it. How It Works A residential proxy network sells access to real home internet addresses. Attackers pay to route their traffic through your connection so it looks like ordinary home browsing, not the datacenter traffic that security tools tend to block. To build that pool, operators need their code running on home devices. Some devices ship with it pre-installed on cheap off-brand hardware; others pick it up when someone installs a free app that hides it. Once it is running, the device becomes an "exit node," a doorway that other people's traffic flows through. Google says an exit node brings outside traffic inside the home network, giving attackers a foothold to reach other devices on it. Some of these home gadgets have also been pulled into large attack botnets such as Mirai and Badbox 2.0. In a single week in June, GTIG counted 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups, to hide their real location and run password-guessing attacks. The Company Behind It Unlike most proxy botnets, NetNut traces back to a public company. In June, researchers at Qurium, Synthient, Nokia Deepfield, and Spur tied Popa to NetNut. NetNut is a proxy provider owned by publicly traded Israeli company Alarum Technologies (NASDAQ: ALAR). In a controlled test, Synthient said traffic it sent into NetNut's commercial gateway came out through a device it had enrolled in Popa. Synthient framed that as evidence of the traffic path, not proof of what NetNut knew or intended. Google's own intelligence aligns: it treats NetNut and Popa as the same network, and says the public reporting matches its view of how NetNut builds its botnet. The Hacker News covered the researchers' findings when they were published. Alarum rejects the "botnet" label. It calls the research "demonstrably inaccurate assertions and flawed deductions rather than verified facts," and says its software is for consented bandwidth-sharing that does not compromise the devices it runs on. The researchers' testing complicates that defense: Synthient reported that none of the more than 20 apps it examined actually showed users a consent prompt. Why One Takedown Isn't Enough Cutting off NetNut is messy by design. NetNut runs a reseller program that lets other companies sell its network under their own brand names. Google says it has high confidence that many popular, seemingly separate proxy brands are really reselling the same NetNut pool. So a single takedown ripples across a lot of brands that look independent but are not. That is also why Google calls this degradation, not a kill. It says its earlier action against a similar IPIDEA network showed these networks can look resilient: operators start buying capacity from rivals, in effect becoming resellers themselves. Real, lasting damage, Google says, means going after several connected providers at once. In January, Google and partners disrupted IPIDEA, a China-based network that at its peak was one of the largest of its kind. In July 2025, Google took the operators of Badbox 2.0 to court, the botnet of hijacked Android TV devices whose components overlap with Popa. Each time, the networks proved stubborn. What Consumers Should Do The single clearest warning sign is an app that offers to pay you for your "unused bandwidth" or for "sharing your internet." That is one of the main ways these networks grow. Beyond that: Stick to official app stores, and check what permissions a VPN or proxy app is asking for. Keep built-in protections like Google Play Protect switched on. Buy streaming boxes and smart TV hardware from known manufacturers, not no-name brands. The demand for these home addresses does not disappear when a network goes down; it just moves. For defenders and platforms, the next signal to watch is whether NetNut-linked traffic resurfaces under reseller brands. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Bandwidth Sharing, botnet, Cybercrime, Google, NetNut, Password Attack, Residential Proxy, Smart TV, Streaming Device, Threat Intelligence ⚡ Top Stories This Week Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data ⭐ Featured Resources Get the 2026 Guide to Govern and Secure Enterprise AI Agents at Scale [Watch Demo] See Which Security Gaps Attackers Could Exploit First AI Can’t Stop Every Attack. Learn How Zero Trust Can Block What’s Unknown Have You Outgrown Your MDR? 7 Warning Signs Every CISO Should Check

Indicators of Compromise

• malware — NetNut
• malware — Popa
• malware — Mirai
• malware — Badbox 2.0

Entities