Direct:
NetNut, one of the larger “residential proxy” services on the market, was operated by Alarum Technologies (NASDAQ: ALAR), a publicly-traded Israeli company. On July 2 the FBI and IRS Criminal Investigation replaced its homepage with a seizure notice, and Google's Threat Intelligence Group (GTIG) disabled the Google accounts and command-and-control the operation relied on. GTIG puts the network at roughly 2 million home devices worldwide, tracked alongside a botnet component called Popa. The public reporting here does not establish that Alarum itself was criminally charged.
GTIG says the network was populated through SDKs bundled into smart-TV and streaming-box apps, in some cases as a component the app needs for playback to work. In a sample of smart-TV apps, Spur found residential proxy SDKs in 42% of LG webOS apps and more than a quarter of Samsung Tizen apps. If one of those devices sits on your network, someone else routes their traffic through your connection and your IP address takes the blame for whatever they do.
For anyone running an auth endpoint, that blame-shifting is the whole problem. During one week in June 2026, GTIG counted 316 distinct threat clusters, both cybercriminal and espionage, using NetNut exit nodes to mask their origin, including for password-spray attacks. From your side those requests arrive from ordinary residential ISP addresses that geo-match a plausible user. IP reputation, geo-fencing, and rate-limiting by source IP lose much of their value on their own against that. The weight shifts to controls like:
- Per-account throttling and risk scoring, with lockout designed to avoid easy account DoS
- Credential-stuffing detection keyed on behavior across accounts and sessions rather than source address
- Phishing-resistant MFA where possible, plus device or session binding
- Treating a normal residential IP as a weak signal, not proof of legitimacy
Worth being honest about sourcing. This takedown has a real primary source: GTIG published its own writeup and the FBI posted a seizure notice on the NetNut domain. What is not public are the specific SDK names, package IDs, and file hashes. Google says it shared those with law enforcement, platform providers, and research firms rather than publishing them, so as of July 2 there are no public IOCs to hunt on. On Android, Google says Play Protect warns on and disables apps it identifies as carrying NetNut SDKs.
If you ship consumer software or pull in third-party SDKs, audit the revenue-sharing and proxy clauses in what you bundle. A proxy SDK can enter through a dependency path the app team never directly reviewed.
Drafted with AI assistance against parallel reporting.
Sources
- Google's Continued Disruption of Malicious Residential Proxy Networks, Google Cloud (GTIG) blog, July 2026
- FBI Seizes NetNut Proxy Platform, Popa Botnet, KrebsOnSecurity, July 2026
- Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices, The Hacker News, July 2026
- Spur research on residential proxy SDKs in LG webOS and Samsung Tizen apps (via KrebsOnSecurity), July 2026
Reddit: https://ift.tt/5WfAnU0