<\/span><\/h3>\nGoogle’s Threat Intelligence Group (GTIG), in a detailed blog post published concurrently with the seizure announcement, elaborated on NetNut’s pervasive role in the cybercrime ecosystem. GTIG confirmed that NetNut’s proxy network was widely resold and often white-labeled by numerous third-party proxy providers. This practice made NetNut’s services highly sought after by cybercriminals aiming to obscure the origins of their malicious traffic. The GTIG reported observing a staggering 316 distinct clusters of threat actors utilizing suspected NetNut exit nodes within a single week in June 2026 alone. This diverse group included entities involved in both cybercriminal activities and espionage.<\/p>\n
"These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks," Google’s GTIG stated in their published analysis. The report further highlighted the significant risks posed to ordinary consumers: "Furthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats."<\/p>\n
Google’s direct involvement in the operation included the disabling of Google accounts and services that NetNut had utilized for command and control of its malware infrastructure. The company also proactively shared critical technical intelligence concerning NetNut’s software development kits (SDKs) and backend infrastructure with various platform providers, law enforcement agencies, and research firms. Additionally, Google took action to disable applications known to bundle NetNut’s various SDKs, further disrupting its operational capabilities.<\/p>\n<\/span>Official Responses and Industry Reactions<\/span><\/h3>\nOmer Weiss, legal counsel for NetNut’s parent company, Alarum Technologies, acknowledged the FBI’s seizure and affirmed the company’s commitment to cooperating with investigators. "Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account," Weiss stated in a written declaration. This statement suggests that Alarum Technologies is positioning itself as a party wronged by the misuse of its services, rather than a direct participant in the illicit activities facilitated by NetNut.<\/p>\n
Benjamin Brundage, founder of the proxy tracking service Synthient and one of the firms that published evidence linking the Popa botnet to NetNut and Alarum Technologies last month, provided an expert perspective on the immediate impact of the domain seizures. Brundage indicated that the action appears to have significantly disrupted both the Popa botnet and the underlying NetNut proxy network. He posited that the apparent demise of NetNut is likely to represent a considerable setback for the cybercrime community, which was already grappling with the aftermath of earlier legal actions taken by Google earlier this year. Those actions targeted the infrastructure of NetNut’s primary competitor, IPIDEA, a move that had propelled NetNut to increased prominence.<\/p>\n
"I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown," Brundage commented. He further elaborated on NetNut’s market position, stating, "Also NetNut has been incredibly common among resellers, and they were on par with IPIDEA in terms of their daily traffic, quality, size, price per gigabyte, all of it."<\/p>\n
<\/span>Broader Implications for Cybersecurity and the Proxy Market<\/span><\/h3>\nThe disruption of the NetNut and Popa botnet infrastructure may yield an additional significant benefit: a reduction in the potency of large-scale distributed denial-of-service (DDoS) botnets. These botnets have frequently leveraged poorly configured residential proxy services to amplify their attacks. Brundage recalled Synthient’s revelation in January concerning the Kimwolf botnet, which was identified as the world’s largest DDoS botnet. This botnet had exploited residential proxy connections, such as those provided by IPIDEA, to tunnel into the local networks of TV box owners, subsequently infecting other Android-based devices behind the victim’s firewall.<\/p>\n
While major proxy providers have reportedly taken steps to mitigate such activities, resellers of these networks have been notably slower to address the escalating threat. "In terms of all these TV box devices getting compromised from the proxy network, it will have an impact on the DDoS botnets out there," Brundage stated, anticipating a dampening effect on these large-scale attack vectors.<\/p>\n
Google’s assessment aligns with this view, estimating that today’s actions have resulted in "significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions." However, the company also issued a cautionary note, highlighting the resilience and adaptability of proxy networks. Google warns that these networks can reconstitute themselves by reselling capacity from other proxy services, a tactic that IPIDEA has demonstrably employed in recent months.<\/p>\n
"Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet," the GTIG report concluded. "While we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient. What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers."<\/p>\n<\/span>A Persistent Threat: Compromised Devices and Smart TV Vulnerabilities<\/span><\/h3>\nThe issue of compromised consumer devices, particularly streaming boxes, remains a persistent concern. As KrebsOnSecurity has repeatedly warned, many unbranded TV streaming boxes available on major e-commerce platforms are either pre-installed with residential proxy software or necessitate the installation of proxy SDKs for their intended functionality, which often includes streaming unauthorized content. Google’s advice to consumers is to opt for reputable brands from trusted manufacturers and to exercise caution and judiciousness when installing applications on these devices.<\/p>\n
The compromised TV boxes implicated in the Popa botnet and other threats often run unofficial Android operating systems that bypass Google’s Play Protect certification. Consumers can verify the authenticity of their Android TV OS and Play Protect certification by consulting Google’s official support documentation.<\/p>\n
The threat extends beyond streaming boxes. Smart televisions from manufacturers like Samsung and LG can also become unwitting participants in residential proxy networks through the installation of third-party applications. A recent report from the proxy tracking company Spur revealed that a significant percentage of apps available for LG’s webOS operating system (42%) contain SDKs that transform the television into a residential proxy node. Similarly, over a quarter of apps designed for Samsung’s Tizen operating system were found to include comparable residential proxy components.<\/p>\n
<\/span>Timeline of Events and Future Outlook<\/span><\/h3>\nThe sequence of events leading to this major enforcement action highlights the critical role of cybersecurity research and industry collaboration:<\/p>\n
\nJanuary 2026:<\/strong> Synthient reveals the Kimwolf botnet, demonstrating how compromised residential proxy networks can be exploited for large-scale DDoS attacks.<\/li>\nEarly 2026:<\/strong> Google takes significant legal action against IPIDEA, a major competitor to NetNut, disrupting its infrastructure.<\/li>\nJune 2026 (Week of June 19th):<\/strong> Three independent cybersecurity firms release parallel findings, linking NetNut to the Popa botnet and identifying its use of consumer devices as proxy nodes.<\/li>\nJune 2026 (Following IPIDEA Takedown):<\/strong> NetNut reportedly experiences a surge in popularity and traffic as cybercriminals seek alternative proxy services.<\/li>\nJuly 2026 (Date of Article Publication):<\/strong> The FBI, IRS-CI, and industry partners, including Google, Lumen, and Shadowserver, execute a coordinated seizure of hundreds of NetNut domains. The NetNut and Alarum Technologies websites display seizure notices.<\/li>\nJuly 2026 (Post-Publication Update):<\/strong> Alarum Technologies’ stock experiences a significant decline, reportedly around a 67% drop over the past week, trading at approximately $2.62 per share.<\/li>\n<\/ul>\nWhile this operation represents a substantial victory against a key player in the residential proxy market, the dynamic nature of the cybercrime landscape suggests that efforts to rebuild and adapt will continue. The interconnectedness of proxy services means that disruptions to one can lead to the growth of others or the adoption of new business models. The ongoing challenge for law enforcement and cybersecurity firms will be to adapt their strategies to target the broader ecosystem of interconnected providers, ensuring a more lasting impact on the illicit use of residential proxy networks. The FBI’s action serves as a strong deterrent, but vigilance and continuous adaptation remain paramount in the fight against cybercrime.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Federal Bureau of Investigation (FBI), in collaboration with a coalition of industry partners, announced today the successful seizure of hundreds of internet domains associated with NetNut, a prominent residential proxy service operated by the publicly traded Israeli company Alarum Technologies (NASDAQ: ALAR). This significant enforcement action, occurring approximately two weeks after investigative reporting by …<\/p>\n","protected":false},"author":9,"featured_media":6682,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[108],"tags":[1470,109,2539,709,1108,3130,1015,255,3132,111,2376,3131,110],"class_list":["post-6683","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-protection","tag-botnet","tag-cybersecurity","tag-dismantle","tag-industry","tag-linked","tag-netnut","tag-network","tag-partners","tag-popa","tag-privacy","tag-proxy","tag-residential","tag-security"],"_links":{"self":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts\/6683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6683"}],"version-history":[{"count":0,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts\/6683\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/media\/6682"}],"wp:attachment":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}