Google and FBI Degrade NetNut Residential Proxy Network

In a coordinated international operation, Google, the FBI, and other partners have significantly degraded a massive residential proxy network known as NetNut or Popa, which had been used by cybercriminals and espionage groups to conceal their activities. The action, announced this week, targeted a botnet believed to consist of at least two million infected Android devices, including smart TVs and streaming boxes, located in homes worldwide.

The operation disabled Google accounts and services used to control the malware, dismantled backend infrastructure, and removed the malicious applications via Google Play Protect. Google also automatically warned victims and shared threat intelligence with law enforcement and industry partners. The company stated the actions reduced the network's pool of usable devices by millions, dealing a major blow to its business operations.

Residential proxy networks sell access to real home internet addresses, allowing clients to route their traffic through those connections. This makes malicious traffic appear as ordinary browsing from a residential location, helping attackers bypass security tools that typically block data-center traffic. In a single...