Google’s Continued Disruption of Malicious Residential Proxy Networks

Google, in coordination with the FBI, Lumen, and partners, disrupted the NetNut residential proxy network (estimated at least ~2 million infected home devices) by disabling C2-linked Google accounts, sharing technical intelligence, and using Play Protect to warn and disable apps containing NetNut SDKs; the network had been used by criminal and espionage actors to mask origins, conduct attacks (including Mirai-linked DDoS), and resell capacity across the residential proxy ecosystem, and Google urges continued coordinated action and consumer caution regarding apps that promise payment for "unused bandwidth."