Loading story…
Google’s Threat Intelligence Group (GTIG) and industry partners took coordinated legal and technical action to disrupt IPIDEA, described as one of the world’s largest residential proxy networks used to mask malicious activity behind legitimate household and small-business IP addresses. Google reported pursuing court action to seize/take down domains used to command infected devices and manage proxy traffic, while also sharing intelligence about IPIDEA software development kits (SDKs) with platform providers, law enforcement, and researchers to enable broader enforcement.
Google said the operation significantly degraded IPIDEA by reducing the available pool of proxy devices by millions, with impact likely extending to affiliated/resold proxy services that share infrastructure. On Android, Google expanded protections via Google Play Protect, including alerting users, removing apps known to include IPIDEA SDKs, and blocking future installation attempts on certified devices. Reporting linked IPIDEA SDKs to enrollment of devices into multiple botnets (including BadBox 2.0, Aisuru, and Kimwolf) and noted GTIG observed 550+ threat groups using IPIDEA exit nodes over a seven-day period in January 2026; affected devices reportedly spanned smartphones, Windows PCs, and other consumer hardware, with US/Canada/Europe residential IPs particularly sought after.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Finland's National Cyber Security Centre said detections of IPIDEA-related activity increased in Finland in early 2026. The advisory described IPIDEA as abusing consumer devices via malicious apps, SDKs, and low-cost Android TV hardware to build a residential proxy network also used to help mask malicious traffic and support DDoS activity.
After the disruption, Lumen still observed around 5 million distinct bots communicating with IPIDEA command-and-control servers, indicating the operation had substantial but incomplete impact. Google described the action as a meaningful partial step against a resilient ecosystem of proxy brands, affiliates, and shell entities.
As part of the disruption effort, Google updated Google Play Protect to warn users, remove apps containing IPIDEA SDKs, and block future installation attempts on certified Android devices. Google said these actions removed millions of proxy-capable devices from the network and reduced IPIDEA's available proxies by an estimated roughly 40%.
Google, working with partners including Cloudflare, Lumen Technologies' Black Lotus Labs, and Spur, carried out a coordinated disruption of the IPIDEA residential proxy network using legal action, technical enforcement, and intelligence sharing. The effort targeted domains used to command infected devices and manage proxy traffic, significantly degrading but not fully eliminating the network.
Before the takedown, Lumen Technologies' Black Lotus Labs observed about 8.5 million proxies connecting daily to IPIDEA servers and estimated the true population at roughly 10 to 11 million devices. Google and partners also linked IPIDEA infrastructure and SDKs to botnet enrollment activity including BadBox 2.0, Aisuru, and Kimwolf.
During a seven-day period in January 2026, Google Threat Intelligence Group observed more than 550 tracked threat groups using IPIDEA-associated residential proxy exit-node IPs. The activity included SaaS access, password spraying, and operations linked to actors associated with China, North Korea, Iran, and Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcecyberscoop.com
Open sourceinfosecurity-magazine.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google and partners disrupted **IPIDEA**, described as one of the world’s largest **residential proxy networks**, which routed attacker traffic through millions of consumer devices acting as proxy “exit nodes.” Google Threat Intelligence Group (GTIG) reported that in a single seven-day period in January 2026, **550+ tracked threat groups** used IPIDEA-linked IPs to obfuscate operations including access to victim *SaaS* environments, intrusion activity against on-premises infrastructure, and **password-spray** attacks; activity was attributed across multiple geographies including **China, DPRK, Iran, and Russia**. IPIDEA allegedly enrolled devices via **SDKs embedded in mobile and desktop applications**, including trojanized apps and “bandwidth monetization” lures, enabling the sale of residential IP space that can be abused for credential abuse, scraping, ad fraud, phishing, and C2 evasion. The disruption effort included **legal action and domain takedowns** against infrastructure used to control devices and proxy traffic, with reporting indicating IPIDEA’s primary site became inaccessible and that the action degraded the available device pool by **millions**. Google also implemented ecosystem enforcement measures, including **Google Play Protect** blocking/removing apps containing IPIDEA SDK components, and shared intelligence intended to reduce re-enrollment and impact related proxy operators that rely on shared/resold device pools and rebranded services (e.g., *360 Proxy*, *Luna Proxy*). Separate reporting tied abuse of residential proxy services like IPIDEA to botnet activity (e.g., **AISURU/Kimwolf**) and highlighted the user risk of having home networks unknowingly used for third-party traffic, increasing exposure to compromise and reputational harm.
Jun 29, 2026
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jul 4, 2026
Google disclosed action against **GRIDTIDE**, a global cyber espionage campaign tracked by Mandiant, saying it disrupted infrastructure tied to the operation and published new threat intelligence on the actor’s activity. The campaign was described as an espionage effort with international reach, and Google said the disruption was intended to hinder the group’s ability to conduct ongoing intrusions and intelligence collection. The disclosure came through a Google Cloud threat intelligence report by Mandiant that framed GRIDTIDE as a coordinated spying operation rather than financially motivated cybercrime. While the public notice focused on the disruption and attribution effort, it also signaled that defenders should review the newly released intelligence for indicators, targeting patterns, and tradecraft associated with **GRIDTIDE** to identify possible exposure and strengthen detection coverage.
Jun 29, 2026