Inside the Takedown of the NetNut Botnet: How Google, the FBI, and Lumen Disrupted a 2-Million-Device Proxy Network

On July 2, 2026, Google's Threat Intelligence Group (GTIG) announced it had significantly degraded the NetNut residential proxy network (also known internally as Popa), working in partnership with the FBI and Lumen Technologies, along with other industry partners . The coordinated action struck at one of the largest known botnets conscripting ordinary home electronics into a global cybercrime relay system.

Google took three concrete steps:

• Disabled accounts and services used for NetNut-related malware command-and-control (C2) operations .
• Shared technical intelligence with law enforcement, including details on NetNut's software development kit (SDK) and backend infrastructure .
• Deployed Google Play Protect to automatically detect, warn users, and disable apps found to be integrating NetNut's proxy code .

Separately, the FBI seized hundreds of domains associated with NetNut and the Popa botnet infrastructure . The FBI also replaced NetNut's homepage with a seizure notice .

The Scale: At Least 2 Million Devices and Growing

• At least 2 million consumer devices worldwide were hijacked to route traffic through residential IP addresses, including smart TVs, Android streaming boxes, phones, and tablets .
• Researchers from Synthient, Qurium, and Nokia Deepfield linked the Popa botnet — which had been operating for roughly four years — directly to NetNut and its publicly-traded parent company Alarum Technologies (NASDAQ: ALAR) .
• Nokia Deepfield estimated the network involved up to 60,000 devices per relay node across 359,000 distinct IP addresses at peak . Some estimates of the total infected pool ranged from 9 to 26 million devices .
• In May 2026 alone, more than 1.4 million internet addresses were hit by data-scraping traffic routed through NetNut .

316 Threat Clusters in a Single Week

In a single week of observation, Google's Threat Intelligence Group detected 316 distinct threat clusters routing malicious traffic through the NetNut proxy infrastructure . These included:

• Advertising fraud
• Credential stuffing and account takeovers
• Mass data-scraping operations
• Phishing campaigns
• Malware C2 relay

How Home Devices Become Part of the Network

Google and researchers identified two primary infection methods:

1. Pre-installed malware — Low-cost Android TV boxes and streaming devices shipped from certain manufacturers with the Popa/Vo1d proxy malware already embedded in the firmware .
2. Hidden proxy code in apps — Seemingly legitimate apps on Google Play or third-party stores secretly contained NetNut's proxy SDK, which silently enrolled the device as a relay node without the user's knowledge. Google Play Protect was used to detect and disable these apps . Security researchers found the code in numerous pirated streaming apps, the torrent client MediaGet, the VPN service RoboVPN, and the Android TV YouTube client SmartTube .

Google's Warning to Consumers

Google warned users to avoid apps that offer payment for unused bandwidth or claim to "share your internet connection for rewards," as these are a common Trojan horse for residential proxy enrollment . Consumers were advised to keep devices updated, avoid cheap unbranded Android TV boxes from unknown vendors, and check which apps have network permissions.

Connection to the Broader Botnet Ecosystem

The Popa botnet used malware derived from the Vo1d/Mzmess family, which shares lineage with Mirai botnet variants targeting Android-based IoT devices . The Aisuru botnet, a Mirai/TurboMirai-class IoT botnet, was also observed pivoting from DDoS attacks to residential proxy models during this period, highlighting an industry-wide shift . The OMG Mirai variant, first documented in 2018, similarly turned IoT devices into proxy servers .

Context: A Continuing Campaign Against Residential Proxy Networks

This action builds directly on Google's January 28, 2026 disruption of the IPIDEA residential proxy network, one of the largest such networks globally at the time . In that operation, Google eliminated domains and accounts used by IPIDEA to route traffic for cybercriminals and state-sponsored attackers . Google assessed then — and reaffirmed in July — that the broader residential proxy industry remains deeply connected to cybercriminal ecosystems, with top services like NetNut, LunaProxy, 711Proxy, and 922Proxy each operating over 1 million exit nodes . The NetNut takedown was part of a continuing campaign that also included the March 2026 disruption of SocksEscort and the June 2026 takedown of the "Outsider" phishing network .

Alarum Technologies issued a statement on July 2, 2026, saying it would "fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated" .