FBI, Partners Seize NetNut Proxy Network Tied to Popa Botnet

Major Disruption Targets Malicious Proxy Infrastructure

U.S. law enforcement, in collaboration with key technology firms, has executed a significant operation against NetNut, a prominent residential proxy network. On July 2, 2026, the Federal Bureau of Investigation (FBI) and the Internal Revenue Service Criminal Investigation (IRS-CI) seized numerous domains tied to NetNut, replacing its homepage with an official seizure notice. This coordinated action aimed to dismantle infrastructure widely exploited by cybercriminals and espionage groups.

NetNut's Operations and Botnet Connections

NetNut, operated by the publicly-traded Israeli company Alarum Technologies (NASDAQ: ALAR), functioned as a residential proxy service. This service allowed users to route internet traffic through IP addresses assigned to ordinary homes and consumer devices. Security researchers have long connected NetNut's infrastructure to the Popa botnet. Findings from multiple security firms in June 2026 highlighted how NetNut populated the Popa botnet by distributing software for common household devices, such as smart TVs and streaming boxes. These devices were then unwittingly transformed into always-on residential proxy nodes. For more information on residential proxies and their uses, see Wikipedia's explanation of proxy servers.

The Popa Botnet's Scale and Misuse

The Popa botnet is estimated to encompass at least two million compromised devices globally. These devices, often infected through deceptive software development kits (SDKs) embedded in unofficial apps or uncertified Android TV operating systems, became exit nodes for illicit traffic. Malicious actors rented access to these nodes to obscure their origins, facilitating various abusive activities. These included mass content scraping, advertising fraud, and account takeover attempts. The Google Threat Intelligence Group (GTIG) reported observing 316 distinct clusters of threat actors using suspected NetNut exit nodes in a single week during June 2026. These groups included both cybercriminals and state-backed espionage operations.

"These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks." — Google Threat Intelligence Group, Blog Post

Google played a crucial role in the disruption, disabling accounts and services NetNut used for malware command and control. They also updated Google Play Protect to warn Android users and disable applications containing NetNut's SDKs. This operation follows Google's earlier disruption of the IPIDEA proxy network in January 2026.

• The FBI and IRS Criminal Investigation led the domain seizures on July 2, 2026.
• NetNut's network comprised at least two million compromised smart TVs and streaming boxes.
• Google identified 316 distinct threat actor clusters using NetNut in a single week in June 2026.

What This Means

This coordinated law enforcement and industry action underscores a growing commitment to combating the misuse of residential proxy networks. For professionals and developers, it highlights the persistent threat of compromised consumer devices being weaponized for cybercrime. The involvement of publicly-traded companies like Alarum Technologies adds a layer of complexity, raising questions about accountability and due diligence in the proxy service industry. While Alarum Technologies has pledged full cooperation with investigators, stating they take the matter seriously, the incident highlights the need for greater transparency and stricter controls over such services. Consumers, in turn, are reminded of the risks associated with installing unofficial software or using uncertified streaming devices, which can inadvertently enroll their home networks into these malicious systems. For Alarum Technologies' official statements, refer to their investor relations page: Alarum Technologies Investor Relations.

Key Points

• The FBI and IRS-CI seized hundreds of NetNut domains on July 2, 2026, disrupting its residential proxy operations.
• NetNut, operated by Alarum Technologies, was linked to the Popa botnet, which leveraged over two million compromised devices.
• Google, Lumen, and Shadowserver collaborated in the takedown, with Google disabling command and control infrastructure.

The Bottom Line

The takedown of NetNut and its associated Popa botnet marks a significant victory against a pervasive form of cybercrime. This operation demonstrates the effectiveness of multi-agency and industry collaboration in disrupting sophisticated malicious networks. However, experts caution that the residential proxy ecosystem is resilient, with operators often rebuilding or white-labeling services, suggesting ongoing vigilance will be essential to protect consumer devices and internet integrity.