The FBI, in collaboration with industry partners including Google, seized hundreds of domains linked to NetNut, a residential proxy service operated by Alarum Technologies. This action followed security research connecting NetNut to the Popa botnet, which comprises over two million devices compromised with little or no user consent. NetNut's software turns consumer devices such as smart TVs and streaming boxes into proxy nodes rented out to third parties, facilitating abusive activities like content scraping, advertising fraud, and account takeover attempts. Google Threat Intelligence Group observed extensive use of NetNut exit nodes by cybercriminal and espionage actors to obfuscate their origins and conduct attacks. The seizure has caused significant degradation of NetNut's proxy network and business operations, disrupting the Popa botnet. Google disabled accounts and services used for command and control and shared intelligence with law enforcement and platform providers. Despite this disruption, the residential proxy ecosystem is resilient, with operators reselling capacity from competitors, necessitating continued efforts to target interconnected infrastructure. Consumers are advised to use official Android TV OS devices and trusted apps to reduce risk of involuntary proxy node participation.

The Popa botnet, leveraging NetNut's residential proxy network, compromised at least two million consumer devices without consent, turning them into proxy nodes for malicious traffic. This enabled cybercriminals and espionage groups to mask their IP addresses, conduct password spraying, content scraping, advertising fraud, and account takeover activities. Unauthorized network traffic passing through infected devices also exposed other devices on the same home networks to potential threats. The FBI seizure and associated actions have significantly disrupted NetNut's infrastructure and the Popa botnet, reducing the pool of compromised devices by millions and impacting cybercrime operations relying on this network. However, the proxy ecosystem's resilience means similar threats may re-emerge through reselling arrangements among proxy providers.

The FBI seizure and coordinated industry actions have significantly disrupted the NetNut proxy network and Popa botnet infrastructure. Google and partners have disabled related accounts, services, and apps used for command and control. Consumers are advised to use name-brand smart TVs and streaming devices with official Android TV OS and Play Protect certification, and to be cautious with app installations, avoiding unofficial or sideloaded apps that may contain proxy SDKs. Continued vigilance and cooperation with law enforcement are necessary to address the fluid residential proxy ecosystem. No direct patch applies to end users, but device hygiene and app vetting reduce risk of involuntary proxy participation.