Google Disrupts NetNut Residential Proxy Network

Google’s Threat Intelligence Group (GTIG) announced that it has significantly degraded NetNut, a residential proxy network that turns consumer routers and IoT devices into rented relays for malicious traffic. The operation, also known under the alias Popa, spanned an estimated two million home devices worldwide, effectively creating a botnet that could route data through unsuspecting households.¹

Working in partnership with the FBI, Lumen Communications, and other industry partners, GTIG reported this week that it had reduced NetNut’s usable device pool by millions. The coordinated effort involved behavioral analysis of unusual outbound connections from consumer IP ranges and passive DNS monitoring across global internet exchanges where proxy data flows before reaching its destination.¹

The technique mirrors earlier Operation Aurora campaigns, but modern residential proxies are far more decentralized, making disruption harder than older centralized infrastructures. Because these networks mask malicious activity such as DDoS mitigation or phishing campaigns targeting vulnerable populations who may not realize their home network is compromised, the FBI’s involvement signals continued aggressive pursuit of such botnets. Expert analysts note that the scale matters: 2 million affected devices imply an estimated $15–30 million annual revenue for Popa based on typical proxy pricing models; Lumen may face lawsuits from impacted customers, and ISPs are expected to scan home routers aggressively using YARA rules designed specifically around these malware packages.

NetNut’s “honey pot” architecture relies on users unknowingly installing software that routes traffic through the network. This obfuscation makes detection difficult, yet the FBI was able to trace some back to infrastructure in China and Russia. With two million devices compromised, the privacy impact is significant—every household could be silently forwarding traffic, potentially exposing personal browsing habits and sensitive data to third parties without consent.

Beyond immediate traffic routing concerns, the shutdown underscores a broader trend in online privacy: large tech firms increasingly collaborate with law enforcement to dismantle distributed botnets that exploit consumer hardware. The partnership between Google GTIG, the FBI, and industry players like Lumen demonstrates how coordinated intelligence can neutralize threats that rely on widespread device infection rather than single high‑profile targets.

The incident also highlights the importance of supply chain vigilance. Citrix Bleed 2 vulnerabilities have previously been exploited by ransomware groups via legitimate remote management tools—a reminder that even trusted enterprise solutions can become vectors if not patched promptly. In the case of NetNut, however, the primary vector was maliciously installed software masquerading as legitimate home networking utilities, reinforcing the need for consumers to verify firmware authenticity and maintain up‑to‑date security patches.

In sum, Google’s disruption of NetNut removes a major component of an underground proxy network that leveraged millions of private homes, reducing potential misuse of personal devices for illicit traffic routing.