Fraud Management & Cybercrime,
Malware as-a-Service,
Social Engineering
2 Million Home Devices, Including Routers and Smart TVs, Tied to NetNut Botnet
Recent operations by the FBI, in coordination with private-sector partners, have successfully disrupted NetNut, a prominent residential proxy network linked to various cybercriminal activities, including the routing of online attacks. This action marks a significant milestone in the ongoing battle against cybercrime.
The takedown was facilitated with help from key players such as Google, Lumen Technologies’ Black Lotus Labs, and the Shadowserver Foundation. Through these collaborative efforts, authorities have managed to seize multiple domain names and render the botnet inoperable by disrupting access to more than 2 million compromised home devices, from routers to smart TVs. The level of collaboration among these entities underscores the complexity and seriousness of modern cyber threats.
In a statement reflecting on the success of this operation, researchers from Google’s Threat Intelligence Group emphasized the impact of their coordinated actions, stating, “We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” This disruption not only represents a tactical victory but also illustrates the significance of teamwork between law enforcement and technology firms in combating cyber threats.
Malicious residential proxies employ a strategy of enlisting consumer devices and selling access to them for criminal purposes. Cybercriminals use these proxies to route their operations through seemingly innocent IP addresses, making detection and prevention efforts by network defenders considerably more complicated. Consequently, the challenge posed by such illicit proxy networks is substantial and growing.
Highlighting the scale of the problem, Austin Larsen, a principal threat analyst at Google, relayed impact metrics, stating, “NetNut secretly hijacked over 2 million home devices like smart TVs and routers, allowing attackers to hide behind innocent users’ IP addresses. To put the scale of this threat into perspective, in a single week during June 2026, our team at GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups.”
It has been reported that illicit users of these residential proxy networks frequently utilize their services for targeting endpoints, enabling them to disguise access to bulletproof services and legitimate infrastructure that have been compromised for launching attacks. These activities not only include data breaches but also automated attacks that utilize various tactics such as password-spraying campaigns.
The operation of such botnets thrives on scale, requiring control over millions of residential IP addresses, especially from regions such as the U.S., Canada, and Europe, which are highly sought after. Google Threat Intelligence researchers have underscored the necessity of these IP addresses in creating functional, robust residential proxy networks. The reach and effectiveness of the NetNut botnet were enabled by distributing software development kits designed to infect varied devices, including smart TVs and streaming boxes.
Furthermore, the threat landscape associated with NetNut extends beyond immediate exploitation to include connections with notorious malware variants such as the Mirai malware, which is known for facilitating Distributed-Denial-of-Service (DDoS) attacks. Google’s researchers also noted that the NetNut botnet has significant overlaps with other operations like the Badbox 2.0, a China-based botnet linked to the infection of millions of off-brand Android devices globally.
The FBI has affirmed that cybercriminals often gain entry into residential networks by either pre-installing malicious software onto devices or infecting them during application downloads, typically during initial setup. In some instances, users are duped into installing potentially harmful software under the guise of sharing unused bandwidth or optimizing internet usage. This highlights the ongoing need for vigilance and awareness among consumers regarding the security of their connected devices.
NetNut operates under the umbrella of Alarum Technologies, an Israeli company publicly traded. In light of these recent developments, Alarum Technologies has expressed its commitment to cooperate with ongoing investigations. Omer Weiss, legal counsel for the firm, stated, “Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account.”
As the landscape of cybercrime continues to evolve, security experts have noted that despite takedowns of major networks like NetNut, criminals often transition to alternative proxy services. This ongoing cat-and-mouse game emphasizes the necessity for robust threat intelligence sharing and decisive actions, including infrastructure blocking by internet service providers and mobile platforms.
Finally, as articulated by Google’s threat researchers, creating a lasting disruption within this fluid ecosystem demands a comprehensive effort to target and dismantle the infrastructure of multiple interconnected providers. In a world increasingly reliant on connected devices, the implications of such disruptions are significant, impacting not only the cybersecurity landscape but also the wider digital economy.