Google Takes Down NetNut Proxy Network and Popa Botnet
Alphabet's Google announced on Thursday that it has significantly weakened a network of Internet-connected devices used to conceal and route malicious online traffic, targeting the NetNut residential proxy operator and the Popa botnet. The tech giant said it disabled accounts and services used in NetNut-related malware command-and-control operations.
Coordinated Action with FBI and Lumen
Google acted in partnership with the FBI and Lumen, among others. The company shared technical intelligence on the group's infrastructure with law enforcement and industry partners to support broader enforcement efforts. Residential proxy networks route Internet traffic through consumer IP addresses, masking its origin and bypassing security defenses. While having legitimate uses, this feature is frequently exploited for cybercrime.
Significant Degradation of NetNut's Operations
“We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions,” Google said in a blog post. NetNut’s parent, Israel-based web data provider Alarum Technologies, was informed of the seizure of some of its domains by the FBI on Thursday, the company told Reuters.
Alarum Technologies Responds
“Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account,” the company said in a statement to Reuters.
FBI Investigation into NetNut and Popa Links
Separately, Bloomberg News reported that the FBI has been examining potential links between NetNut and Popa for more than a year, citing documents seen and people familiar with the situation. The investigation was one of several reviewed by officials from multiple federal law enforcement agencies during a Colorado meeting on proxy networks late last year. The FBI did not immediately respond to a Reuters request for comment.
