NetNut, also known as Popa, was a residential proxy network powered by more than 2 million compromised Android devices infected via trojanized applications and malware such as Badbox 2.0. The network rented proxy access to various threat actors, including cybercriminal and espionage groups, enabling them to hide their locations during attacks like password spraying. Google, the FBI, and other organizations coordinated a takedown operation that disabled Google accounts and services used for command-and-control, removed infected apps via Google Play Protect, and warned victims. This operation caused significant degradation to NetNut's infrastructure and business, reducing the available infected device pool by millions. NetNut also operated a reseller program, allowing other brands to white-label its proxy services. The takedown follows similar disruptions of related proxy botnets and aims to scale efforts against interconnected providers in this ecosystem.

The disruption of NetNut significantly reduced the availability of millions of compromised devices used as residential proxies by cybercriminals and nation-state actors to mask their identities during attacks. This degradation impacts the ability of threat actors to conduct operations such as password spraying and unauthorized access while hiding their true locations. The takedown also affects the broader proxy botnet ecosystem by disrupting reseller networks and forcing operators to seek alternative sources, potentially reducing overall malicious proxy capacity.

Google and partners have already taken coordinated action to dismantle the NetNut network by disabling command-and-control infrastructure, removing infected applications via Google Play Protect, and warning victims. These measures have significantly degraded the threat. No additional immediate action is required from defenders regarding this specific threat. Continued monitoring of related proxy botnet activity and collaboration with industry and law enforcement is recommended to address the evolving ecosystem.