FBI dismantles NetNut botnet using millions of hidden proxy devices

The FBI, in collaboration with Google's cybersecurity units, has successfully neutralized NetNut, a vast botnet that exploited millions of user devices worldwide to function as a hidden proxy infrastructure. The operation targeted a network that comprised over 2 million devices, including smart TVs, streaming boxes, and various Android gadgets.

These connected devices were reportedly used to automatically reroute internet traffic through users' home IP addresses, a process of which the owners were unaware. The core of this scheme involved a malicious software development kit (SDK) embedded in inexpensive Android devices and certain applications, including third-party content viewers. Once installed, this software turned devices into nodes within a distributed proxy network, enabling malicious actors to mask their activities.

Investigators determined that in a single week in June 2026, NetNut's infrastructure was utilized by hundreds of groups for a range of illicit activities. These included brute-force password attacks, credential theft, advertising fraud, and the collection of sensitive information. A key characteristic of NetNut was its operation as a commercial proxy service rather than a traditional underground botnet.

Experts have linked the infrastructure to Alarum Technologies, an Israeli company whose shares are traded on Nasdaq. Previously, Alarum had stated it offered users a voluntary internet resource exchange service. However, independent research suggested that device owners might not have been adequately informed about how their connections were being used. Following the seizure of NetNut-related domains, Alarum announced its cooperation with law enforcement. Google confirmed that NetNut's model allowed other companies to rebrand and resell access to the proxy infrastructure. In response, Google seized related domains, blocked associated command-and-control server accounts, and updated its Google Play Protect system to detect applications containing the malicious SDK.