Back Securityaffairs.Co

Law enforcememt operation disrupted Malicious Residential Proxy Networks NetNut

Securityaffairs.Co •Pierluigi Paganini • July 3, 2026

Google disrupted NetNut, a major proxy network that routed internet traffic through compromised devices used by cybercriminals. Google has disrupted NetNut, one of the world’s largest residential proxy networks. The service routed internet traffic through devices, allowing customers to hide their real location and identity. “Today, in coordination with the FBI, Lumen, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google and FBI Disrupt NetNut Proxy Network Linked to 2 Million Devices On July 3, 2026, Google, in coordination with the FBI and other partners, disrupted the NetNut residential proxy network, also known as the Popa botnet. This operation targeted over 2 million compromised consumer devices, primarily smart TVs and streaming boxes, which were used to route malicious traffic and conceal cybercriminal activities. The disruption involved disabling Google accounts and services tied to the botnet's command-and-control operations and sharing technical intelligence with law enforcement. In June 2026 alone, 316 distinct threat clusters exploited NetNut for various cybercrimes, including password spraying and credential stuffing. Google’s actions are expected to significantly degrade NetNut’s operations, reducing the pool of available devices for the proxy operators by millions. The operation builds on previous efforts against the IPIDEA proxy network, indicating a broader campaign to dismantle residential proxy networks. The ongoing nature of these disruptions highlights the resilience of such networks and the need for continued enforcement efforts. 54 sources 77

Extracted Entities

Tools (1)

NetNut