NetNut Proxy Network Disrupted, 2 Million Infected Devices Cut Off

NetNut (Popa) — a large malicious residential proxy service reportedly controlling at least 2 million compromised Android devices and consumer electronics — was disrupted by a joint operation involving Google, the FBI, Lumen, Shadowserver and other partners. The network routed attacker traffic through victim home IPs (enabling evasion and large-scale password-spraying), served hundreds of threat actors via a reseller model, and had domains and C2 infrastructure taken down while Google disabled associated accounts and warned users.