Google and FBI Disrupt NetNut Proxy Network Linked to 2 Million Devices

On July 3, 2026, Google, in coordination with the FBI and other partners, disrupted the NetNut residential proxy network, also known as the Popa botnet. This operation targeted over 2 million compromised consumer devices, primarily smart TVs and streaming boxes, which were used to route malicious traffic and conceal cybercriminal activities. The disruption involved disabling Google accounts and services tied to the botnet's command-and-control operations and sharing technical intelligence with law enforcement. In June 2026 alone, 316 distinct threat clusters exploited NetNut for various cybercrimes, including password spraying and credential stuffing. Google’s actions are expected to significantly degrade NetNut’s operations, reducing the pool of available devices for the proxy operators by millions. The operation builds on previous efforts against the IPIDEA proxy network, indicating a broader campaign to dismantle residential proxy networks. The ongoing nature of these disruptions highlights the resilience of such networks and the need for continued enforcement efforts.

Key Points: • Google and FBI disrupted the NetNut proxy network, affecting over 2 million devices. • The operation targeted malicious traffic routing used in cybercrime, including credential stuffing. • This disruption is part of a larger campaign against residential proxy networks, following the IPIDEA takedown.