Google and FBI dismantle NetNut proxy botnet

Google Threat Intelligence, the FBI, and international partners have disrupted the NetNut residential proxy botnet, also known as Popa, which compromised at least 2 million devices worldwide.

The botnet converted infected consumer devices, including smart TVs and streaming boxes, into residential proxies that were rented to cybercriminals. These proxies helped attackers obscure their origins and conduct activities ranging from credential stuffing to account takeovers.

The disruption operation involved sinkholing infrastructure and taking down domains used to control the network. Users are advised to factory-reset suspicious IoT devices, update firmware, and monitor network traffic for unusual connections.