316 Threat Clusters Hit as Google, FBI Dismantle 2M-Node NetNut Proxy

For cybersecurity professionals, the NetNut takedown is both a lesson in the scale of modern botnets and a call to action. With 2 million compromised IoT devices and 316 threat clusters actively using them for password spraying, the operation reveals how residential proxy networks have become critical infrastructure for attackers — and how public-private collaboration can dismantle them overnight.

In a coordinated operation in June 2026, Google’s Threat Analysis Group (TAG) and the Federal Bureau of Investigation (FBI) dismantled NetNut, one of the largest residential proxy networks ever discovered, comprising over 2 million compromised Android devices. The botnet, also known as Popa, was used by hundreds of cybercriminal and state-sponsored actors for credential theft, espionage, and anonymizing illicit activities. Google’s action, which included severing command-and-control (C&C) infrastructure, disabling associated accounts, and deploying Google Play Protect to clean infected devices, marked a significant escalation in the ongoing fight against proxy-as-a-service botnets.

“

NetNut leveraged trojanized applications and malware like Badbox 2.0 to infect smart TVs, streaming boxes, and other Android-based IoT devices, turning them into unwitting proxies.

NetNut leveraged trojanized applications and malware like Badbox 2.0 to infect smart TVs, streaming boxes, and other Android-based IoT devices, turning them into unwitting proxies. The operator, linked to the publicly-traded Israeli firm Alarum Technologies Ltd, sold access to this residential proxy network under the NetNut brand and also operated a reseller program, allowing other proxy providers to whitelabel the botnet. This business model enabled a fluid ecosystem where disruption of one botnet could simply push demand to another. Indeed, Google noted that when faced with degradation of their own botnet, proxy operators begin buying capacity from competitors, becoming resellers themselves. The January 2026 takedown of IPIDEA, another large proxy network, had already demonstrated this phenomenon, and Google observed a spillover effect now with NetNut’s dismantling.

The scale of malicious activity funneled through NetNut was staggering. In a single week in June, Google identified 316 distinct threat clusters using the proxy network to hide their true locations during attacks, including widespread password-spray campaigns against cloud services and enterprise accounts. Such residential proxies are invaluable to attackers because they make traffic appear to originate from legitimate home IP addresses, bypassing geo-fencing and IP reputation filters. NetNut’s proxies were rented by diverse adversaries: financially motivated cybercriminals, nation-state espionage groups, and even initial-access brokers (IABs) who would then sell access to compromised networks.

The technical impact of the takedown is substantial. Google disabled Google accounts and associated services that served as the botnet’s backend C&C, effectively paralyzing command logic and telemetry collection. Simultaneously, Google Play Protect — the built-in security system on Android devices — remotely disabled the infected applications across millions of devices, automatically warning victims and mitigating the threat without user intervention. This dual-pronged approach of neutralizing infrastructure and cleansing endpoints is a model for future botnet operations. Nevertheless, Google acknowledged the inherent fluidity of the proxy marketplace: operators may simply absorb residual bots and relaunch under a different brand or via reseller networks. Creating lasting disruption requires sustained, scalable targeting of the entire infrastructure chain, from command servers to payment processors.

From an industry perspective, this operation underscores the escalating threat posed by residential proxy botnets, which have become a critical component of the cybercrime supply chain. The NetNut case highlights how consumer IoT devices — often with weak security and long patch cycles — are increasingly conscripted into botnets. The involvement of a publicly-traded company also raises questions about corporate accountability and due diligence in the proxy market. Alarum Technologies’s association (even if indirect) signals that proxy services can operate in regulatory gray zones, and that deeper scrutiny from financial regulators and exchanges may be needed.