FBI Seizes NetNut Proxy Platform, Disrupts Popa Botnet
The Federal Bureau of Investigation (FBI) has worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. This action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.
NetNut's Residential Proxy Network
NetNut's software turns devices commonly found in homes, such as smart TVs and streaming boxes, into always-on residential proxy nodes that are rented to others. These proxies are predominantly used to relay abusive and intrusive Internet traffic, such as mass content scraping, advertising fraud, and account takeover activity.
The Google Threat Intelligence Group (GTIG) said NetNut's proxy network is widely resold and white-labeled by a number of third-party proxy providers, and that its services are heavily sought out by cybercriminals seeking to obfuscate the source of their malicious traffic. In a single week during June 2026, they observed 316 distinct clusters of threat actors using suspected NetNut exit nodes, including cybercriminal and espionage groups.
These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks. Furthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats.
Impact of the Seizure
Google said it disabled Google accounts and services used by NetNut for malware command and control, and that it shared technical intelligence on NetNut's software development kits (SDKs) and backend infrastructure with platform providers, law enforcement, and research firms. The company also disabled apps known to bundle NetNut's various SDKs.
Omer Weiss, legal counsel for NetNut parent Alarum Technologies, said the company was aware of the FBI seizure and cooperating with investigators. Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account.
Effects on the Cybercrime Community
Benjamin Brundage, founder of the proxy tracking service Synthient, said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it. Brundage said NetNut's apparent demise is likely to be a great disadvantage for the cybercrime community, which was already reeling from legal actions by Google earlier this year that seized infrastructure for NetNut's biggest competitor — IPIDEA.
The NetNut and Popa botnet takedown may have another added benefit, Brundage said: Lessening the impact of large distributed denial-of-service botnets that have been built on the backs of poorly configured residential proxy services.
Consumer Advice
Google's advice is sound: When it comes to TV boxes, stick to name brands from reputable manufacturers, and then be sparing and judicious with any apps you choose to install. The sketchy TV boxes that are being commandeered by the Popa botnet and other threats all come with or require the user to install unofficial Android operating systems that do not operate within the confines of Google's Official Play Protect store.
Consumers can confirm whether or not a device is built with the official Android TV OS and Play Protect certification by following these instructions. Even people without TV streaming boxes can find their smart TVs enrolled in residential proxy networks, just by installing one of thousands of apps available for download on Samsung and LG smart TVs.
- 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one's television into an always-on residential proxy node.
- More than a quarter of the apps made for Samsung's Tizen operating system had similar residential proxy components.
Update, 4:24 p.m. ET: Included a statement shared post-publication from an attorney representing NetNut parent Alarum Technologies.
Source: Krebs on Security