Google Dismantles NetNut Residential Proxy That Hacked 2 Million Home Devices

Google, working with law enforcement and industry partners, disrupted the NetNut (aka Popa) residential proxy network—an active botnet of SDK-infected and pre-compromised home devices estimated in the millions—that was being resold and used by cybercriminal and espionage groups for proxying, password-spraying, and infrastructure obfuscation; the report details attribution to NetNut/Alarum Technologies, linked infrastructure (domains and controller counts), third-party analyses, and recommended mitigations including Play Protect warnings and coordinated blocking.