Cybersecurity Policy Report, Google, FBI Disrupt Botnet That Harnessed Connected Home Devices, (Jul 6, 2026)
A “residential proxy network” that harnessed connected TVs and other home devices to conceal malicious cyber activity was disrupted by the Google Threat Intelligence Group (GTIG) and federal law enforcement, according to Google.
“Residential proxy networks sell the ability to route traffic through IP addresses owned by internet service providers (ISPs), allowing attackers to mask malicious activity by hijacking these IP addresses,” GTIG explained in a blog post.
“Home devices become part of proxy networks either because they are pre-installed with malware before purchase or because users unknowingly download applications containing hidden proxy code. This creates serious risks for unsuspecting device owners, as their home IP addresses can be used by attackers as a launchpad for hacking and other unauthorized activities,” it said.
Google’s operation targeted NetNut, a provider of residential proxy services, and a botnet known as Popa. NetNut’s Internet domain was seized by the Federal Bureau of Investigation and Internal Revenue Service as part of a criminal probe. Google disabled NetNut’s Google accounts and services after determining they were used “for malware command and control (C2), which directly violates Google’s Terms of Service and Acceptable Use Policy,” GTIG said.
It also updated its Google Play security protections to block downloads associated with NetNut and its affiliates, it said. “We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions,” it noted.
“Consumers should be extremely wary of applications that offer payment in exchange for ‘unused bandwidth’ or ‘sharing your internet.’ These applications are primary ways for malicious proxy networks to grow, and could open security vulnerabilities on the device’s home network,” GTIG warned.
GTIG conceded that its actions against NetNut would have a limited impact. “What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers,” it said.
NetNut and the FBI had no immediate comment. In its seizure notice, the FBI acknowledged the assistance of Lumen’s Black Lotus Labs and the Shadowserver Foundation.
News: FederalLegislation LitigationEnforcement DataSecurity