FBI Dismantles NetNut Proxy Network: A Major Blow to the Global Botnet Ecosystem

In a decisive strike against the shadowy infrastructure fueling global cybercrime, the Federal Bureau of Investigation (FBI) has seized hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The coordinated operation, which also involved the Internal Revenue Service’s Criminal Investigation division, marks a significant escalation in the war against the "residential proxy-as-a-service" industry—a sector increasingly utilized by bad actors to facilitate everything from account takeovers to large-scale industrial espionage.

The seizure follows weeks of intense scrutiny after independent security researchers linked NetNut to the Popa botnet, a massive collection of at least two million compromised devices. These devices, ranging from smart TVs to budget streaming boxes, were weaponized without the consent of their owners, effectively turning household internet connections into conduits for illicit traffic.

The Chronology of the Takedown

The collapse of NetNut was not a sudden event but the culmination of a weeks-long investigative spotlight.

• Mid-June 2026: Three separate security firms released synchronized findings revealing that NetNut’s residential proxy network served as the backbone for the Popa botnet. Researchers demonstrated how NetNut’s software was bundled into seemingly innocuous applications, converting home devices into "always-on" proxy nodes.
• Late June 2026: Google’s Threat Intelligence Group (GTIG) intensified the pressure, publicly identifying NetNut as a primary source of malicious traffic obfuscation. Google began disabling accounts, blocking malware command-and-control servers, and removing applications from its ecosystems that utilized NetNut’s software development kits (SDKs).
• Early July 2026: The FBI and IRS-CI executed a massive domain seizure. By the morning of the operation, users attempting to access NetNut’s homepage were greeted with an official law enforcement banner.
• July 8, 2026: The reach of the law enforcement action expanded. The primary corporate portal for Alarum Technologies, alarum.io, was also seized by the FBI. Investors reacted sharply to the news, sending Alarum’s stock plummeting by roughly 67% to $2.62 per share.

Anatomy of the Popa Botnet and NetNut’s Role

At the heart of this controversy is the "residential proxy" model. In a legitimate scenario, these services allow companies to verify advertising or conduct market research by routing traffic through real residential IP addresses, making the activity appear as if it originates from a typical consumer.

However, as researchers at firms like Synthient and Black Lotus Labs have documented, the NetNut infrastructure crossed into criminal territory. By distributing malicious SDKs—often pre-installed on low-cost, uncertified Android TV boxes or hidden within popular smart TV apps—NetNut created a parasitic network.

When a user installs an app containing the NetNut SDK, their home network becomes an exit node for the service. Criminals then rent these nodes to mask their own IP addresses. According to Google’s findings, this allows threat actors to conduct "password spray" attacks, scrape sensitive proprietary data, and execute sophisticated account takeover (ATO) campaigns while remaining effectively invisible to the victims’ security systems.

Furthermore, because these proxy nodes reside behind the victim’s firewall, the malicious traffic does not just pass through the TV or streaming box; it can potentially access other connected devices on the same home network, including laptops, smartphones, and IoT security cameras.

Supporting Data: The Scale of the Abuse

The scope of the operation revealed by industry partners—including Google, Lumen, and Shadowserver—is staggering. Google’s Threat Intelligence Group reported that in a single week in June, they observed 316 distinct clusters of threat actors leveraging suspected NetNut exit nodes. These clusters included not only opportunistic cybercriminals but also state-sponsored espionage groups.

The prevalence of these proxies in consumer hardware is even more alarming. A recent report by the proxy tracking service Spur found that approximately 42% of apps available for download on LG’s webOS smart TV platform contained residential proxy SDKs. Similarly, over a quarter of apps for Samsung’s Tizen operating system were found to harbor similar components. These statistics highlight a systemic vulnerability in the smart home ecosystem, where convenience is often prioritized over security and privacy.

Official Responses and Corporate Accountability

Following the seizure, Alarum Technologies attempted to mitigate the fallout through legal representation. Omer Weiss, counsel for the company, issued a statement confirming that Alarum was aware of the FBI’s actions and was cooperating fully with federal investigators.

"Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account," Weiss stated.

Despite this pledge, the company faces a precarious future. Beyond the catastrophic drop in share price, the company must contend with the reality that its core product—the residential proxy infrastructure—has been effectively dismantled by global law enforcement.

Google, for its part, has taken an aggressive stance. Beyond just identifying the threat, the company has actively shared intelligence regarding NetNut’s backend infrastructure with international law enforcement agencies and industry peers. "We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers," a GTIG report noted.

Implications for the Future of Cybersecurity

The dismantling of NetNut and the Popa botnet is a tactical victory, but experts warn that the war is far from over. Benjamin Brundage, founder of the proxy tracking service Synthient, notes that the "proxy-as-a-service" market is notoriously resilient.

"I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown," Brundage said, referring to a similar enforcement action against a major competitor earlier this year. "However, the ecosystem is fluid. When one provider goes down, the operators often pivot to becoming resellers for other, smaller, or less visible networks."

The "Reseller" Problem

Google’s report confirms this fear, noting that many residential proxy brands are effectively "white-labeling" the same underlying botnet infrastructure. When a primary provider is taken down, these secondary brands simply purchase capacity from surviving competitors, allowing the malicious traffic to continue uninterrupted.

Protecting the Consumer

For the average consumer, the lesson is clear: the hardware we bring into our homes is a significant security vector.

1. Stick to Known Brands: Avoid "no-name" streaming boxes sold on major e-commerce platforms, which are the primary targets for the injection of proxy SDKs.
2. Verify Certification: Consumers can check if their Android TV devices are official by ensuring they are Play Protect certified.
3. Exercise Caution with Apps: Be highly selective about the apps installed on smart TVs. If an app requires permissions that seem unrelated to its function—such as persistent network access or background activity—it should be avoided.

The FBI’s action against NetNut marks a pivotal moment in regulating the proxy industry. By targeting the providers themselves rather than just the individual end-user devices, law enforcement is forcing a change in the economic model of cybercrime. Whether this leads to a permanent decline in residential botnets or merely a temporary disruption remains to be seen. However, for now, one of the most prolific tools in the cybercriminal’s arsenal has been rendered, at least temporarily, powerless.