Google Disrupts NetNut Residential Proxy Network in Coordinated Action

Summary

Google says it disrupted NetNut, a residential proxy network linked to a botnet of at least 2 million devices, by disabling related accounts and services and using Play Protect to warn users and disable known apps.

Key points

Google acted against NetNut, also known as Popa, in coordination with the FBI, Lumen, and others.
Google disabled accounts and services it says NetNut used for malware command and control, and shared intelligence about its SDKs and backend infrastructure.
Google Play Protect now warns users about and disables applications known to include NetNut SDKs, and is intended to block future installation attempts.
Google estimates NetNut's network included at least 2 million devices; it says the disruption reduced the available device pool by millions.
NetNut SDKs have been distributed through applications and connected home devices, including smart TVs and streaming boxes, enrolling devices as proxy exit nodes.
GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes in one week in June 2026, including cybercriminal and espionage groups.
Google says proxy operators may shift to competitors after disruptions and plans to continue tracking NetNut and related providers.

Article Details

Event Type: Coordinated disruption of the NetNut residential proxy network, also known as Popa, by Google in coordination with the FBI, Lumen, and others.
Impact: Google disabled Google accounts and services used by NetNut for malware command and control, and Google Play Protect warned users about and disabled applications known to incorporate NetNut SDKs. Google believes the actions significantly degraded the network and reduced its available device pool by millions. GTIG estimates the network includes at least 2 million devices; it observed 316 distinct threat clusters using suspected NetNut exit nodes during one week in June 2026.

Malware

Badbox 2.0GTIG has also identified NetNut botnet plugin components for large-scale botnets such as Badbox 2.0.MiraiPublic reports by Synthient, Spur, Nokia Deepfield, and others have documented the use of NetNut to infect devices with variants of Mirai DDoS botnets.

Vendors

GoogleToday, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa.

Products

AndroidWe ensured Google Play Protect, Android’s built-in security protection, automatically warned users and disabled applications known to incorporate NetNut SDKs, and the system will continue to protect users against future Google Play ProtectWe ensured Google Play Protect, Android’s built-in security protection, automatically warned users and disabled applications known to incorporate NetNut SDKs, and the system will continue to protect users against future