FBI Seizes NetNut Proxy Network Linked to Popa Botnet, Shutting Down Millions of Devices

The Federal Bureau of Investigation announced today, in coordination with industry partners, the seizure of more than ↓ 300 domains that powered the NetNut proxy service operated by Israeli‑listed Alarum Technologies (NASDAQ:ALAR).

NetNut proxy Tied to Popa Botnet of ↓ 2 million Compromised Devices

Security researchers from KrebsOnSecurity, Google Threat Intelligence Group and independent firms converged in mid‑June to link the residential‑proxy platform to the Popa botnet, a network of at least two million smart TVs, streaming boxes and other IoT gadgets infected without user consent.

The botnet converts these home devices into always‑on exit nodes that criminals rent to hide malicious traffic, fuel mass content scraping, advertising fraud and account‑takeover campaigns.

“Alarum takes this matter seriously and will fully cooperate with law enforcement,” said Omer Weiss, legal counsel for the NetNut parent, in a written statement.

Google’s GTIG reported observing 316 distinct threat‑actor clusters leveraging suspected NetNut exit nodes in a single week, ranging from cyber‑crime groups to state‑linked espionage units. The firm also disabled Google accounts used for command‑and‑control and removed apps bundling NetNut SDKs.

Industry allies including Reuters and Bloomberg were thanked for assistance in dismantling the infrastructure, which experts say will cripple the cyber‑crime ecosystem that surged after the earlier takedown of rival IPIDEA.

Analysts predict a short‑term shock to the residential‑proxy market, but warn that resilient operators may re‑brand or purchase capacity from competitors, keeping the threat alive.

Analysis by Nova Stirling (Aerospace & Space Tech Correspondent).