Google Disrupts Net Nut Residential Proxy Network Spanning 2 Million Home Devices
Summary: Google's Threat Intelligence Group, working with the FBI and Lumen, degraded NetNut, a residential proxy network it estimates spans at least 2 million home devices including smart TVs and streaming boxes, reducing its pool of usable devices by millions. In a single week in June, GTIG counted 316 distinct threat clusters using suspected NetNut exit nodes for cybercriminal and espionage activity, and researchers tied the network, also tracked as Popa, to publicly traded Alarum Technologies, which rejects the botnet label and says its software is for consented bandwidth sharing.
Bottom line: Google calls this a degradation rather than a kill because NetNut's reseller program means many seemingly separate proxy brands draw on the same pool, and its earlier IPIDEA action showed operators simply buy capacity from rivals when one network goes down. The 316 threat clusters in one June week show how much criminal and espionage traffic was riding on ordinary home connections.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026