Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks

Gbhackers •Divya • July 3, 2026

Google has disrupted the NetNut residential proxy botnet, a large-scale infrastructure widely exploited for malware command-and-control (C2) operations and password spray attacks. This coordinated effort involved the FBI, Lumen, and various industry partners. It was announced by Google’s Threat Intelligence Group (GTIG) on July 3, 2026. This action is part of an ongoing campaign to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google and FBI Disrupt NetNut Proxy Network Linked to 2 Million Devices On July 3, 2026, Google, in coordination with the FBI and other partners, disrupted the NetNut residential proxy network, also known as the Popa botnet. This operation targeted over 2 million compromised consumer devices, primarily smart TVs and streaming boxes, which were used to route malicious traffic and conceal cybercriminal activities. The disruption involved disabling Google accounts and services tied to the botnet's command-and-control operations and sharing technical intelligence with law enforcement. In June 2026 alone, 316 distinct threat clusters exploited NetNut for various cybercrimes, including password spraying and credential stuffing. Google’s actions are expected to significantly degrade NetNut’s operations, reducing the pool of available devices for the proxy operators by millions. The operation builds on previous efforts against the IPIDEA proxy network, indicating a broader campaign to dismantle residential proxy networks. The ongoing nature of these disruptions highlights the resilience of such networks and the need for continued enforcement efforts. 54 sources 77

Extracted Entities

Google Disrupts NetNut Residential Proxy Botnet Used for Malware C2 and Password Spray Attacks

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (2)

Tools (1)