‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
Summary: Researchers from Qurium, Synthient and others concluded that the Popa botnet, an Android TV-box proxy network active for four years, is linked to NetNut, a residential proxy provider run by publicly-traded Israeli firm Alarum Technologies. Qurium traced control domains including ninjatech.io to NetNut VP of R&D Moishi Kramer, who said Ninjatech sold a Popa SDK about five years ago and that he no longer controls the domain or infrastructure, while Synthient said it assesses with high confidence that devices running Popa forward traffic from NetNut clients.
Key Takeaway: Black Lotus Labs puts Popa at 1.5 million to 2.5 million distinct IP addresses daily, and Nokia Deepfield counted 750,000 unique sources in 24 hours across just 26 of at least 359 known relay nodes - traffic that Spur says anyone can buy through a reseller with a burner email and $5 in crypto.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026