Google, FBI disrupt NetNut proxy botnet of 2M devices

A joint operation involving Google has disrupted NetNut, a residential proxy network also known as Popa that gave cybercriminals and espionage groups access to at least 2 million compromised Android devices worldwide, including smart TVs and streaming boxes.

NetNut powered attacks through infected consumer hardware. The botnet turned compromised home devices into always-on residential proxy nodes, allowing threat actors to conceal malicious traffic by routing it through victims' legitimate residential IP addresses. According to the Google Threat Intelligence Group, NetNut comprised at least 2 million infected devices powered by trojanized applications and botnets like Badbox 2.0 that package proxy plugins. Krebs on Security reports the network was operated by publicly traded Alarum Technologies, listed on NASDAQ as ALAR.

Infected devices typically became part of the botnet after malware was pre-installed before purchase or added via malicious or trojanized applications downloaded by users. As exit nodes, they routed unauthorized network traffic, often resulting in the devices being flagged as suspicious or blocked by internet service providers and online services. The Register notes the botnet mainly consisted of small TV-streaming hardware.

Coordinated takedown targeted infrastructure and domains. The effort included Google, the FBI, Lumen Technologies, The Shadowserver Foundation and other industry partners. The FBI seized the netnut.com domain along with hundreds of other domains tied to the network. Google disabled accounts and services on its infrastructure that NetNut operators used for malware command-and-control, blocking access to critical backend infrastructure.

Google also protected users by automatically warning them and disabling infected applications through Google Play Protect. The company shared technical details on NetNut's software development kits and backend command-and-control infrastructure with platform providers, law enforcement agencies and cybersecurity researchers.

NetNut served hundreds of threat actors last month alone. Google Threat Intelligence Group observed 316 distinct threat clusters using suspected NetNut exit nodes in one week last month, including cybercriminal and espionage groups. Threat actors used the network to access their own infrastructure, conduct password-spraying attacks and reach victim environments. The malicious proxy service is considered one of the largest in the world.

Disruption follows earlier action against similar networks. Google expects the move to have a broader impact in the proxy industry because NetNut operated a robust reseller program that allowed whitelabeling of its network, with many popular residential proxy services fueled by it. Mark Karayan, Communications Manager at Mandiant, told BleepingComputer that the proxy industry is deeply interconnected, with operators constantly buying and reselling each other's botnet capacity. The action against NetNut follows the disruption of IPIDEA earlier this year and is part of Google's commitment to dismantle residential proxy botnets.