Google has significantly degraded one of the world’s largest residential proxy networks, NetNut, which turns everyday home devices—including smart TVs and streaming boxes—into rented relays for cybercriminal traffic. In a coordinated operation with the FBI, Lumen, and other partners, Google’s Threat Intelligence Group (GTIG) announced this week that it has reduced the network’s pool of usable devices by millions, disrupting a system that at its peak controlled at least two million home endpoints worldwide.
NetNut, also tracked under the name Popa, is a residential proxy network that sells access to real home internet addresses. Threat actors pay to route their malicious traffic through these consumer connections, making their activity appear as ordinary home browsing rather than datacenter traffic that security tools typically block. If a device in your home has been enrolled, strangers can route their traffic through your internet connection, and your IP address takes the blame for whatever they do—from password-guessing attacks to espionage.
How the NetNut Proxy Network Turns Home Devices Into Exit Nodes
The mechanics of this operation are both simple and alarming. To build its pool of residential IPs, NetNut needs its code running on home devices. Some off-brand smart TVs and streaming boxes ship with the software pre-installed; other devices become infected when users install a free application that secretly includes the proxy code. Once running, the device functions as an “exit node,” a doorway that funnels third-party traffic into and out of the home network.
According to GTIG, an exit node does more than just relay traffic—it brings outside traffic inside the home network, giving attackers a foothold to reach other connected devices. Some of these compromised home gadgets have also been pulled into large-scale attack botnets such as Mirai and Badbox 2.0, which are known for launching distributed denial-of-service (DDoS) attacks and other malicious activities.
The Scale of Abuse: 316 Threat Clusters in a Single Week
The operational impact of NetNut is staggering. In a single week in June, GTIG identified 316 distinct threat clusters using suspected NetNut exit nodes. These clusters included both cybercriminal groups and state-sponsored espionage actors, all relying on the network to hide their real geographic locations and evade detection. Their primary activities included large-scale credential-stuffing and password-spraying attacks against cloud services and enterprise networks.
NetNut’s Corporate Backing and the Consent Controversy
Unlike most proxy botnets that operate anonymously, NetNut traces back to a publicly traded company. Alarum Technologies (NASDAQ: ALAR), an Israeli firm, is the owner of NetNut. Independent researchers from Qurium, Synthient, Nokia Deepfield, and Spur recently published findings connecting the Popa botnet directly to NetNut. In a controlled test, Synthient demonstrated that traffic it sent into NetNut’s commercial gateway exited through a device it had enrolled in the Popa network, providing clear evidence of the traffic path.
Alarum has rejected the “botnet” label, calling the research “demonstrably inaccurate assertions and flawed deductions.” The company maintains that its software is a consented bandwidth-sharing service. However, Synthient’s testing complicates that defense: researchers reported that none of the more than 20 apps they examined actually displayed a consent prompt to users. This raises significant questions about whether the owners of the two million enrolled devices were ever informed that their internet connections were being sold to cybercriminals.
Why Degradation, Not a Kill: The Reseller Problem
Google is careful to describe this operation as a “degradation” rather than a complete takedown. The reason lies in NetNut’s business model. The company operates a reseller program that allows other firms to sell access to its network under their own brand names. Google has high confidence that many popular, seemingly separate proxy brands are in fact reselling the same NetNut pool. Consequently, a single takedown action can disrupt a network of apparently independent brands all at once.
Past operations have shown that these networks are resilient. In January, Google and partners disrupted IPIDEA, a China-based network that was one of the largest of its kind. In July 2025, Google took the operators of Badbox 2.0 to court. In both cases, the networks proved stubborn, with operators often buying capacity from rivals or reappearing under different brand names. Real, lasting damage, Google explains, requires simultaneous action against several interconnected providers.
What Consumers Should Do to Protect Their Home Networks
The clearest warning sign that a device might be enrolled in a proxy network is an offer to pay you for your “unused bandwidth” or for “sharing your internet connection.” This is the primary recruitment method for networks like NetNut. To protect yourself, take the following steps:
- Stick to official app stores and carefully review the permissions requested by any VPN or proxy application. If an app asks for unnecessary access to your network settings, be wary.
- Keep built-in protections active. Services like Google Play Protect can help detect and block malicious applications before they install.
- Buy streaming devices from reputable manufacturers. Avoid cheap, off-brand smart TVs and streaming boxes, as these are more likely to ship with pre-installed proxy software.
How to Protect Yourself If You Are Already Affected
If you suspect a device in your home has been compromised, take immediate action. Start by performing a factory reset on any suspicious streaming box or smart TV, then update it to the latest firmware from the manufacturer’s official site. Change the passwords for your home Wi-Fi network and any online accounts you access from that connection. Enable multi-factor authentication on all critical accounts—email, banking, and social media—as an additional layer of defense. Finally, consider using a reputable no-log VPN service when browsing, which adds encryption and masks your real IP address from potential threats. By choosing a solution that meets strict privacy standards—such as a VPN with a verified no-logs policy, AES-256 encryption, and a built-in kill switch—you can ensure your online activity remains private and secure even if your home network is under threat.
