cyber.hendryadrian.com
Security News · bleepingcomputer.com

Google and FBI Disrupt NetNut Proxy Botnet Linked to 2 Million Devices

· Original article ↗

Summary

Google, the FBI and partners disrupted NetNut, a residential proxy botnet. Google estimates it involved at least 2 million compromised devices and blocked its C2 infrastructure; Play Protect warned users and disabled infected apps.

Key points

  • Google Threat Intelligence Group estimates NetNut, also known as Popa, involved at least 2 million compromised devices worldwide, including Android devices, smart TVs and streaming boxes.
  • Compromised devices served as residential exit nodes, helping cybercriminal and espionage groups conceal traffic and reach victim environments.
  • GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes in one week, including for password-spraying attacks.
  • Google, the FBI, Lumen Technologies, the Shadowserver Foundation and other partners took part in the disruption.
  • Google disabled accounts and services used for NetNut command-and-control and used Play Protect to warn users and disable infected apps.
  • The FBI took down netnut[.]com, which the article identifies as one of several domains used by the service.

Article Details

Event Type
Coordinated disruption of the NetNut residential proxy botnet by Google, the FBI, and industry partners.
Impact
The FBI took down a domain used by NetNut, including netnut.com, and Google blocked NetNut command-and-control infrastructure and used Google Play Protect to warn users and disable infected applications. Google Threat Intelligence Group estimated that NetNut controlled at least 2 million compromised devices worldwide; this is an estimate, not a confirmed count.

Indicators of compromise

TypeIndicatorContext
DOMAINnetnut[.]comDomain identified as used by the NetNut residential proxy network and taken down by the FBI.

MITRE ATT&CK

T1090.002 · External ProxyThreat actors used NetNut residential proxy exit nodes to route traffic through residential IP addresses and conceal its origin.T1110.003 · Password SprayingThreat actors used NetNut exit nodes to conduct password-spraying attacks.

People

Mark KarayanMandiant Communications Manager who confirmed that the .com domain was used by NetNut and discussed disruption effects in comments to BleepingComputer.

Malware

Badbox 2.0globally (including smart TVs and streaming boxes), powered by trojanized applications and botnets like Badbox 2.0 that package proxy plugins,” Google told BleepingComputer.

Vendors

GoogleGoogle, the FBI, and industry partners disrupted NetNut, a massive residential proxy network that used millions of compromised Android devices, smart TVs, and streaming boxes to hide malicious traffic behind residential

Products

Androidpartners disrupted NetNut, a massive residential proxy network that used millions of compromised Android devices, smart TVs, and streaming boxes to hide malicious traffic behind residential IP addresses.Google Play ProtectThe takedown also blocked NetNut’s command-and-control infrastructure and used Google Play Protect to warn users and disable infected apps.

Related Articles