Threat Intel
Google Disrupts NetNut Residential Proxy Network, Cuts Millions of Devices
Google, in partnership with the FBI and Lumen, disabled accounts and services tied to NetNut’s Popa proxy network, shared SDK and C2 intelligence, and triggered Play Protect warnings. The action has removed millions of devices from the botnet and is expected to ripple across the residential proxy ecosystem.
What Happened
Google, together with the FBI, Lumen, and other partners, targeted the NetNut residential proxy network, also known as Popa, for its use in malware command‑and‑control. Google disabled all Google accounts and services that NetNut used for C2 operations, violating Google’s Terms of Service.
Impact
The disruption removed millions of devices from NetNut’s botnet, significantly shrinking the proxy pool. Google Play Protect automatically warned users and disabled any apps that incorporated NetNut SDKs, preventing future install attempts.
What Defenders Should Do
- Verify that any applications on your infrastructure do not embed NetNut SDKs or other known malicious proxy components.
- Check your device inventory for unauthorized residential proxy connections and quarantine affected endpoints.
- Keep your security tools up to date, especially Google Play Protect and any endpoint detection and response solutions.
Ongoing Measures
Google shared technical intelligence on NetNut’s SDKs and backend C2 infrastructure with platform providers, law enforcement, and research firms to raise ecosystem‑wide awareness. The company expects the disruption to have a ripple effect across other residential proxy brands that may be whitelabeling the same botnet.
Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet.
Related articles
U.S. Government Disrupts DPRK‑Linked FAMOUS CHOLLIMA Laptop Farms with CrowdStrike Support
The FBI and CrowdStrike dismantled several laptop farms operated by the DPRK‑affiliated threat group FAMOUS CHOLLIMA, exposing fraudulent use of compromised laptops within U.S. companies. Defenders should audit remote‑access logs, isolate affected devices, and strengthen endpoint detection and response controls.
Read briefing
LG Bans Residential Proxy Apps from Smart TVs
LG Electronics will suspend any webOS app that turns a TV into an always‑on residential proxy. The move follows research showing over 42% of webOS apps embed proxy SDKs, exposing users to traffic routing and privacy risks.
Read briefing
U.S. Government Disrupts DPRK‑Linked FAMOUS CHOLLIMA Laptop Farms
The FBI and CrowdStrike dismantled a network of laptop farms run by the DPRK‑affiliated threat actor FAMOUS CHOLLIMA, which was deploying stolen credentials to infiltrate U.S. companies. The operation exposed compromised laptops and credential reuse across multiple organizations. Defenders should audit device inventories, enforce least‑privilege access, and monitor for anomalous credential use.
Read briefing
ClearFake Campaign Uses WebDAV and Fake CAPTCHA Lures to Deploy Amatera Stealer
Cybersecurity researchers have uncovered a new ClearFake infection campaign that leverages fake Google CAPTCHA prompts and WebDAV shares to distribute the Amatera information stealer. The multi-stage attack tricks users into running malicious commands, resulting in the deployment of secondary payloads such as ZigCryptoStealer, a Go-based reverse proxy, and unauthorized instances of NetSupport Manager. Activity targeting a Ukrainian government organization has been linked to a threat cluster tracked as UAT-10820.
Read briefing