NetNut was a large residential proxy botnet controlling at least two million infected Android-based devices worldwide, including smart TVs and streaming boxes. It operated by infecting devices with malware or trojanized apps that installed proxy plugins, enabling threat actors to route traffic through legitimate residential IP addresses to conceal malicious activity. The botnet was used by hundreds of threat actors for activities such as password spraying and infrastructure access. A joint operation by Google Threat Intelligence Group, FBI, and industry partners dismantled NetNut by seizing domains, disabling command-and-control infrastructure, and removing infected apps via Google Play Protect. The disruption also involved sharing technical details with law enforcement and platform providers. NetNut's reseller program interconnected it with other proxy services, indicating a broader impact on the residential proxy ecosystem.

The disruption cut off access to a large proxy network that enabled cybercriminals and espionage groups to hide malicious traffic behind millions of legitimate residential IP addresses. This reduces the ability of threat actors to conduct attacks using these compromised devices and limits their capacity to evade detection. The takedown also affects the broader proxy industry due to NetNut's reseller relationships. However, no direct exploitation of a specific vulnerability or ongoing active exploits were reported. The infected devices were used as exit nodes for unauthorized network traffic, potentially causing service disruptions or blocking by ISPs prior to the takedown.

The disruption operation included domain seizures, disabling of backend infrastructure, and removal of infected applications through Google Play Protect. Users of infected devices were automatically warned and protected by Google. No further action is required from end users as the botnet infrastructure has been dismantled and infected apps disabled. Security teams should monitor for similar residential proxy networks but immediate remediation for this threat is complete.