Google disrupts NetNut proxy network, cutting device pool by millions

Alphabet Inc.'s Google said Thursday it weakened the NetNut residential proxy network, a sprawling infrastructure of at least 2 million internet-connected devices used to route malicious online activity, in a coordinated takedown with the FBI and Lumen Technologies.

"These coordinated actions have caused significant degradation to NetNut's proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions," Google's Threat Intelligence Group said in a blog post.

Google disabled accounts and associated services used by NetNut for malware command-and-control operations, shared technical intelligence on the group's software development kits and backend infrastructure with law enforcement, and deployed Google Play Protect to automatically warn users and disable applications found to incorporate NetNut's SDKs. The proxy network, also known as Popa, offered rotating residential, ISP, mobile and datacenter proxies that allowed users to route internet traffic through consumer IP addresses, masking the origin of activity and bypassing security defenses. NetNut was founded in 2017 as a subsidiary of Alarum Technologies, an Israeli cybersecurity firm.

Residential proxy networks serve legitimate purposes such as ad verification and web scraping, but their ability to obscure traffic sources makes them attractive to cybercriminal groups seeking to hide malware distribution and phishing campaigns. Google's action marks one of the largest takedowns of such an infrastructure, targeting a network that the company's threat intelligence unit estimated at a minimum of 2 million devices. The tech giant said it shared its findings with industry partners to support broader enforcement efforts, though it did not disclose whether any arrests or criminal charges resulted from the operation.

This article is for informational purposes only and does not constitute investment advice.