Loading story…
Google said it disrupted NetNut—also known as Popa—a large residential proxy network that investigators linked to malware delivery, command-and-control activity, and efforts by cybercriminal and espionage actors to mask their origin IP addresses while accessing victim environments. Working with the FBI, Lumen, and other partners, Google disabled accounts and services allegedly used by the operation, shared technical intelligence on NetNut SDKs and backend infrastructure, and used Google Play Protect against apps that incorporated the NetNut SDK. Google estimated the network relied on at least 2 million devices and said 316 threat clusters used suspected NetNut exit nodes during a single week in June.
The coordinated action also included FBI seizures of NetNut-associated domains, a move that parent company Alarum Technologies said disrupted part of the service and could materially affect operations and financial results if the outage persists. Google said the operation significantly degraded the network and cut its available device pool by millions, describing the move as part of a broader campaign against malicious proxy providers after an earlier action against IPIDEA. The disruption is being viewed as a blow not only to a botnet-linked service but also to the broader supply of residential proxy infrastructure relied on by multiple threat actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Alarum Technologies, NetNut's parent company, disclosed that FBI seizures of domains associated with NetNut disrupted part of its services. The company said a prolonged disruption could materially affect operations and financial results.
Google said it coordinated with the FBI, Lumen, and other partners to disable Google accounts and services allegedly used by NetNut, also known as Popa, for malware command-and-control and other unauthorized cyber activity. Google said the action significantly degraded the network and reduced its available device pool by millions.
During one week in June 2026, Google observed 316 distinct threat clusters using suspected NetNut exit nodes. Google also assessed NetNut as a residential proxy network involving at least 2 million devices.
Google previously carried out a disruption effort against the IPIDEA proxy network as part of a broader campaign against interconnected malicious proxy providers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceblog.alphahunt.io
Open sourcecyberveille.ch
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google’s **Threat Intelligence Group (GTIG)** and industry partners took coordinated legal and technical action to disrupt **IPIDEA**, described as one of the world’s largest *residential proxy* networks used to mask malicious activity behind legitimate household and small-business IP addresses. Google reported pursuing court action to seize/take down domains used to command infected devices and manage proxy traffic, while also sharing intelligence about **IPIDEA software development kits (SDKs)** with platform providers, law enforcement, and researchers to enable broader enforcement. Google said the operation **significantly degraded** IPIDEA by reducing the available pool of proxy devices by **millions**, with impact likely extending to affiliated/resold proxy services that share infrastructure. On Android, Google expanded protections via **Google Play Protect**, including alerting users, removing apps known to include IPIDEA SDKs, and blocking future installation attempts on certified devices. Reporting linked IPIDEA SDKs to enrollment of devices into multiple botnets (including **BadBox 2.0**, **Aisuru**, and **Kimwolf**) and noted GTIG observed **550+ threat groups** using IPIDEA exit nodes over a seven-day period in January 2026; affected devices reportedly spanned smartphones, Windows PCs, and other consumer hardware, with US/Canada/Europe residential IPs particularly sought after.
Jun 29, 2026
Researchers from Synthient, Qurium, Nokia Deepfield, and others said the long-running **Popa** Android proxyware ecosystem enrolls phones, tablets, streaming devices, and unofficial Android TV boxes into a residential proxy network, and linked parts of that activity to **NetNut**, a proxy provider owned by **Alarum Technologies**. The reporting describes Popa as a plugin tied to the `Vo1d` malware ecosystem that can maintain persistent encrypted tunnels and relay third-party traffic for uses including advertising fraud, account takeovers, mass scraping, and possible access into local networks. Estimates cited by researchers put the network at roughly **1.5 million to 2.5 million daily IPs**, indicating years of operation at significant scale. Synthient said it identified multiple Popa-related variants, including **Moneytiser**, **Loopop**, and **Neupop**, and found that analyzed samples often began proxying traffic as soon as the host app launched. In controlled testing, the firm said some Popa-enrolled devices egressed traffic through NetNut’s commercial proxy gateway, while 18 Android samples communicated directly with `sdk.netnut.io` and some APKs referenced both `sdk.netnut.io` and `cyberprotector.online`; researchers also said none of more than 20 examined publishers invoked an optional consent prompt present in version `2.7.46`. **NetNut** rejected the findings and said it operates a legitimate proxy network with KYC, due-diligence, and misuse-monitoring controls, while broader reporting warned that embedded residential proxy SDKs in consumer apps are increasingly being used for AI-related scraping without meaningful user consent.
Jul 12, 2026
Google and partners disrupted **IPIDEA**, described as one of the world’s largest **residential proxy networks**, which routed attacker traffic through millions of consumer devices acting as proxy “exit nodes.” Google Threat Intelligence Group (GTIG) reported that in a single seven-day period in January 2026, **550+ tracked threat groups** used IPIDEA-linked IPs to obfuscate operations including access to victim *SaaS* environments, intrusion activity against on-premises infrastructure, and **password-spray** attacks; activity was attributed across multiple geographies including **China, DPRK, Iran, and Russia**. IPIDEA allegedly enrolled devices via **SDKs embedded in mobile and desktop applications**, including trojanized apps and “bandwidth monetization” lures, enabling the sale of residential IP space that can be abused for credential abuse, scraping, ad fraud, phishing, and C2 evasion. The disruption effort included **legal action and domain takedowns** against infrastructure used to control devices and proxy traffic, with reporting indicating IPIDEA’s primary site became inaccessible and that the action degraded the available device pool by **millions**. Google also implemented ecosystem enforcement measures, including **Google Play Protect** blocking/removing apps containing IPIDEA SDK components, and shared intelligence intended to reduce re-enrollment and impact related proxy operators that rely on shared/resold device pools and rebranded services (e.g., *360 Proxy*, *Luna Proxy*). Separate reporting tied abuse of residential proxy services like IPIDEA to botnet activity (e.g., **AISURU/Kimwolf**) and highlighted the user risk of having home networks unknowingly used for third-party traffic, increasing exposure to compromise and reputational harm.
Jun 29, 2026