In a strategic operation, Google and the FBI collaborated with other organizations to dismantle NetNut, a prominent residential proxy network. Known as Popa, this network reportedly comprises over 2 million Android devices, including smart TVs and streaming boxes, compromised through malware like Badbox 2.0.
Background on NetNut’s Operations
NetNut, linked to the Israeli company Alarum Technologies Ltd, has been renting its residential proxies to malicious actors, including cybercriminal and espionage groups. Throughout a single week in June, Google identified 316 different threat groups leveraging NetNut to conceal their locations for password-spray attacks and unauthorized access to victim systems.
Google’s coordinated actions have significantly disrupted NetNut’s operations, reducing the number of available devices for proxy activities by millions. This takedown involved disabling Google accounts and services used for command-and-control purposes, effectively crippling the botnet’s infrastructure.
Implementation and Impact of the Takedown
The tech giant also deactivated infected applications via Google Play Protect and issued automatic warnings to affected users. Furthermore, Google shared valuable threat intelligence with industry partners and law enforcement agencies to enhance collective cybersecurity defenses.
Beyond operating under its brand, NetNut facilitates a reseller program, allowing other brands to white-label its proxy services. This multifaceted approach has made NetNut a significant player in the proxy ecosystem.
Future Implications for Cybersecurity
Following the disruption of IPIDEA in January, the NetNut takedown is expected to have a cascading effect across the proxy landscape. Google notes that proxy operators, when faced with such disruptions, often start acquiring capacity from competitors, turning into resellers themselves. Therefore, achieving lasting impact in this dynamic ecosystem requires targeting the underlying infrastructure of interconnected providers.
This operation underscores the ongoing efforts and challenges in combating large-scale cyber threats and highlights the necessity for continued vigilance and collaboration across global cybersecurity fronts.
