Google Says It Degraded NetNut Proxy Network Using Millions of Home Devices

Summary

Google and partners say they reduced NetNut/Popa’s pool of home-device proxies by millions. GTIG estimates the network spans at least 2 million devices, but warns it may reemerge through resellers or rival networks.

Key points

Google’s Threat Intelligence Group says work with the FBI, Lumen, and others reduced NetNut’s usable device pool by millions; the network is degraded, not eliminated.
GTIG estimates NetNut, also tracked as Popa, spans at least 2 million devices worldwide, including smart TVs and streaming boxes.
In one week in June, GTIG counted 316 distinct threat clusters using suspected NetNut exit nodes, including for password-guessing attacks.
Qurium, Synthient, Nokia Deepfield, and Spur linked Popa to NetNut. Synthient’s controlled test showed traffic through NetNut’s gateway exiting via a device enrolled in Popa; it said this did not establish what NetNut knew or intended.
Alarum Technologies rejects the botnet characterization. Synthient reported that none of the more than 20 apps it examined showed users a consent prompt.
Google says reseller brands and providers buying capacity from rivals could help the network reemerge; it points to earlier disruption efforts involving IPIDEA and Badbox 2.0.
The article advises avoiding apps offering payment for unused bandwidth, using official app stores and built-in protections, and choosing devices from known manufacturers.

Article Details

Event Type: Google-led disruption and degradation of the NetNut (also tracked as Popa) residential proxy network.
Impact: Google, working with the FBI, Lumen, and others, says it reduced NetNut’s usable device pool by millions. GTIG estimates the network includes at least 2 million devices and counted 316 distinct threat clusters using suspected NetNut exit nodes in one week in June. The network can route outside traffic through home internet connections and provide access to other devices on home networks. Google describes the operation as degradation, not elimination, and warns that activity may reappear through reseller brands. Researchers linked Popa to NetNut; Alarum disputes the botnet characterization. Synthient said its test demonstrated a traffic path, not what NetNut knew or intended.

MITRE ATT&CK

T1090 · ProxyThreat clusters reportedly used suspected NetNut exit nodes as proxies to hide their real locations.T1110.001 · Password GuessingGTIG reported that threat clusters using suspected NetNut exit nodes ran password-guessing attacks.

Malware

Badbox 2.0Some of these home gadgets have also been pulled into large attack botnets such as Mirai and Badbox 2.0.Mirai#NetNut #Popa #AlarumTechnologies #Badbox2.0

Vendors

Alarum TechnologiesNetNut is a proxy provider owned by publicly traded Israeli company Alarum Technologies (NASDAQ: ALAR).NetNutGoogle, working with the FBI, Lumen, and others, says it has sharply degraded NetNut (also known as Popa), a residential proxy network that used millions of home devices as rented relays for outside traffic.