Back Feeds.4Sysops

FBI and Google dismantle NetNut proxy botnet hiding in smart TVs

Feeds.4Sysops •IT News • July 3, 2026

The FBI and Google coordinated a global operation to disrupt NetNut, a massive residential proxy network that co-opted over two million consumer devices. This network, also tracked as the Popa botnet, primarily targeted Android-based smart TVs and streaming boxes through deceptive software development kits. These SDKs were often bundled into unofficial apps or inexpensive hardware, turning internet connections into exit nodes for third-party traffic without meaningful user consent. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google and FBI Disrupt NetNut Proxy Network Linked to 2 Million Devices On July 3, 2026, Google, in coordination with the FBI and other partners, disrupted the NetNut residential proxy network, also known as the Popa botnet. This operation targeted over 2 million compromised consumer devices, primarily smart TVs and streaming boxes, which were used to route malicious traffic and conceal cybercriminal activities. The disruption involved disabling Google accounts and services tied to the botnet's command-and-control operations and sharing technical intelligence with law enforcement. In June 2026 alone, 316 distinct threat clusters exploited NetNut for various cybercrimes, including password spraying and credential stuffing. Google’s actions are expected to significantly degrade NetNut’s operations, reducing the pool of available devices for the proxy operators by millions. The operation builds on previous efforts against the IPIDEA proxy network, indicating a broader campaign to dismantle residential proxy networks. The ongoing nature of these disruptions highlights the resilience of such networks and the need for continued enforcement efforts. 28 sources 77

Extracted Entities

FBI and Google dismantle NetNut proxy botnet hiding in smart TVs

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Tools (1)