In a sweeping coordinated operation, the Federal Bureau of Investigation (FBI) and the Internal Revenue Service Criminal Investigation (IRS-CI) division have effectively dismantled the infrastructure of NetNut, a massive residential proxy service operated by the publicly-traded Israeli firm Alarum Technologies (NASDAQ: ALAR). The takedown, which saw the seizure of hundreds of domains, marks a significant milestone in the ongoing effort to disrupt the "Popa" botnet—a vast, illicit network of approximately two million compromised devices.
This operation represents a major escalation in law enforcement’s fight against the commercialization of residential proxy networks, which have increasingly become the backbone of modern cybercriminal activities, including large-scale account takeovers, advertising fraud, and sophisticated espionage.
Chronology of a Takedown
The collapse of NetNut was not a sudden event, but the culmination of a months-long investigation involving multiple international security firms, private sector threat intelligence teams, and federal law enforcement agencies.
- November 2025: Security researchers begin identifying a concerning trend: low-cost, "no-name" Android streaming boxes sold on major e-commerce platforms are arriving pre-installed with malicious residential proxy software.
- January 2026: The proxy tracking service Synthient reveals the existence of the "Kimwolf" botnet, exposing how cybercriminals were using compromised proxy connections to tunnel into private home networks, effectively weaponizing residential hardware for massive DDoS attacks.
- June 19, 2026: In a synchronized disclosure, three independent cybersecurity firms publicly link NetNut’s residential proxy network to the "Popa" botnet. The findings detail how NetNut distributed software development kits (SDKs) to domestic devices, turning them into "always-on" exit nodes for global traffic.
- July 2026: Google’s Threat Intelligence Group (GTIG) releases a comprehensive report detailing how NetNut served as a primary obfuscation tool for 316 distinct clusters of threat actors in a single week.
- Today: The FBI replaces the NetNut homepage with an official seizure banner. Shortly thereafter, the website for parent company Alarum Technologies (alarum[.]io) is also seized, reflecting the severity of the legal action.
Supporting Data: The Anatomy of the Popa Botnet
The Popa botnet is not a traditional malware infection that seeks to crash systems; rather, it is a parasitic infrastructure that thrives on stealth. By embedding itself into smart TVs, streaming boxes, and other IoT (Internet of Things) hardware, the botnet exploits the device’s legitimate internet connection to route malicious traffic.
How the Proxy Network Operates
According to data from Black Lotus Labs and Lumen, NetNut’s architecture was designed to provide a "clean" facade for "dirty" traffic. When a cybercriminal needs to bypass a security filter, they rent a node from the NetNut network. Because the traffic originates from a residential IP address rather than a known data center, security systems are significantly less likely to block or flag the activity.
The Scale of Abuse
The GTIG report highlights the staggering volume of traffic funneled through these nodes. During a single week in June 2026, researchers observed hundreds of distinct threat actor groups—ranging from petty scammers to state-sponsored espionage entities—utilizing NetNut infrastructure to mask their true origin IP addresses.
The security implications are profound. When a device becomes an exit node, it creates a "backdoor" into the home network. This allows bad actors to probe other private devices behind the same firewall, effectively transforming a harmless smart TV into a bridge for further network exploitation.
Official Responses and Corporate Accountability
The takedown of NetNut has sent shockwaves through the proxy-as-a-service industry. While the FBI has credited partners like Google, Lumen, and Shadowserver for their intelligence support, the parent company of the seized network has been forced to address its legal predicament.
The Position of Alarum Technologies
Omer Weiss, legal counsel for Alarum Technologies, issued a statement following the seizure, acknowledging the company’s awareness of the FBI action. "Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account," Weiss noted.
However, the market’s reaction to the news has been catastrophic for the firm. Following the seizure of the alarum[.]io domain, the company’s stock price plummeted, losing approximately 67% of its value in a single week, trading at $2.62 per share at the time of reporting.
Google’s Role in Disruption
Google’s intervention went beyond mere intelligence gathering. The company proactively disabled Google accounts used by NetNut for command-and-control communication and purged apps from its ecosystem that were found to be bundling the malicious SDKs. "We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers," a Google spokesperson stated.
Implications: The Future of Residential Proxy Ecosystems
The dismantling of NetNut, while a victory for law enforcement, leaves a power vacuum that experts warn may be short-lived.
The "Whitelabeling" Problem
Benjamin Brundage, founder of the proxy tracking service Synthient, notes that the industry is deeply interconnected. Many "competitor" proxy providers are simply resellers or "whitelabel" operators who utilize the same underlying botnet infrastructure. When one provider is taken down, these resellers often migrate to another, creating a "whack-a-mole" dynamic.
"I think this takedown is going to have a big impact because NetNut gained significant popularity after the IPIDEA takedown earlier this year," Brundage explained. "However, the ecosystem is incredibly resilient. When faced with the loss of their primary provider, operators often buy capacity from their competitors, effectively becoming a reseller overnight."
A Warning for Consumers
The FBI’s action underscores a critical security lesson for the general public: the danger of non-certified hardware. The Popa botnet relies heavily on low-cost, uncertified Android streaming devices that circumvent Google’s "Play Protect" certification.
Experts advise that consumers should:
- Stick to reputable brands: Avoid off-brand streaming boxes that lack official certification.
- Verify OS integrity: Use the official Google Play Protect certification verification tools to ensure a device is running a secure version of the Android OS.
- Audit Smart Home Apps: Be highly selective with applications installed on smart TVs. Research from Spur found that up to 42% of apps on some platforms contained residential proxy SDKs, which effectively turn the TV into a public proxy node without the user’s informed consent.
Conclusion: A Shift in Cybersecurity Enforcement
The seizure of NetNut marks a pivotal shift in how law enforcement approaches cybercrime. By targeting the infrastructure—the domains, the SDKs, and the corporate entities that facilitate these botnets—rather than just the end-users or individual hackers, the FBI is attacking the business model of cybercrime itself.
However, the "residential proxy" problem is far from solved. As the proxy market continues to evolve, the distinction between legitimate proxy services and criminal botnets has become increasingly blurred. For now, the takedown of NetNut provides a temporary reprieve for the global internet, but it also serves as a stark reminder of how easily our personal devices can be weaponized against us in the shadows of the digital economy.
As investigations continue, the focus will likely turn to the resellers and "white-label" providers who remain active. The ripple effects of this operation will be felt for months to come, as security researchers and law enforcement work to map the shifting landscape of the residential proxy ecosystem.
