Google Disrupts Netnut Proxy Network Linked to Infected Home Devices

Summary

Google says it disrupted Netnut, a residential proxy network linked to millions of infected devices. Researchers found apps distributing its code lacked consent screens; Google also said it disabled related apps and services.

Key points

Google’s threat intelligence group described Netnut, also called Papa, as a large residential proxy network involving at least 2 million infected devices, including smart TVs and streaming boxes.
Devices reportedly received the software pre-installed or through apps offering payment for unused bandwidth. Researchers found no consent screen in more than 20 apps they examined; Alarium Technologies disputed the research and called the bandwidth sharing consensual.
Google shut down accounts and services Netnut used to operate command-and-control servers and enabled Play Protect to detect and disable apps carrying Netnut code. Google said its actions reduced the available device pool by millions.
Google counted 316 threat groups using Netnut in one week to hide their locations and conduct password-spray attacks. Researchers also linked Netnut-infected devices to Mirai variants and Badbox 2.0.
The roundup reported Pam Stealer, a macOS infostealer disguised as the Maccy clipboard manager, and Rustock, malware targeting routers, IP cameras, Android devices, and servers for DDoS use.
Peter Stokes was extradited from Finland to the US to face federal hacking charges. According to court documents, he has been linked to at least four Scattered Spider breaches.

Article Details

Topics: [00:17] Netnut/Papa residential proxy network, infected home devices, and Google’s disruption
[02:36] Cloudflare’s crawler monetization gateway and payment model
[03:43] Hak5’s SharkJack display product mention
[03:53] Pam Stealer disguising itself as the Maccy clipboard manager
[04:16] Rustock malware and its reported DDoS purpose
[04:27] Reward offered for information about an unnamed Russian state cyber group
[04:42] Scattered Spider and Peter Stokes’s reported links to breaches and federal charges

MITRE ATT&CK

T1110.003 · Password SprayingGoogle said threat groups used Netnut to conceal their locations while conducting password-spray attacks against targets.

Malware

RustockA malware family reported in the wild that targets routers, IP cameras, Android devices, and servers for use in DDoS attacks.

Products

Play ProtectGoogle enabled Play Protect to automatically detect and disable apps carrying Netnut code.SignalThe roundup reported that an unnamed Russian state cyber group compromised Signal accounts belonging to reporters and US government employees.WhatsAppThe roundup reported that an unnamed Russian state cyber group compromised WhatsApp accounts belonging to reporters and US government employees.