In a sweeping coordinated strike against the infrastructure fueling global cybercrime, the Federal Bureau of Investigation (FBI) has seized hundreds of web domains associated with NetNut, a sprawling residential proxy service operated by the publicly traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The takedown, executed with the assistance of the Internal Revenue Service (IRS) Criminal Investigation division and a coalition of industry partners, marks a significant escalation in the ongoing war against the illicit “proxy-as-a-service” industry.
The seizure represents the culmination of a weeks-long investigation triggered by revelations that NetNut’s vast network of residential proxies was inextricably linked to the Popa botnet. This massive digital infrastructure, consisting of at least two million compromised devices—predominantly smart TVs and streaming boxes—has been used to facilitate everything from large-scale advertising fraud and content scraping to sophisticated account takeover attacks.
A Chronology of the NetNut Collapse
The trajectory toward today’s enforcement action began in mid-June 2026, when a trifecta of independent security research firms published damning evidence linking NetNut to the Popa botnet.
- June 19, 2026: Three distinct security organizations released findings documenting how NetNut’s software development kits (SDKs) were embedded in low-cost consumer electronics. These SDKs effectively hijacked home hardware, turning unsuspecting users’ devices into “always-on” residential proxy nodes.
- Late June 2026: Security researchers at Google’s Threat Intelligence Group (GTIG) and other private firms began mapping the extent of the abuse, identifying that NetNut was being utilized as a primary obfuscation tool for diverse threat actors, ranging from espionage groups to financial cybercriminals.
- July 2026: The FBI and IRS-CI initiated the formal seizure of hundreds of domains tied to the NetNut infrastructure. Visitors to the NetNut website were greeted with a stark federal seizure banner, signaling the end of the firm’s unhindered operations.
- July 8, 2026: The collapse widened as the primary corporate domain for the parent company, Alarum Technologies (alarum.io), was also hit with a federal seizure notice. Following the news, Alarum’s stock price plummeted by roughly 67 percent, settling at approximately $2.62 per share.
The Mechanics of the Popa Botnet
The Popa botnet is not a traditional collection of servers; it is a distributed, residential-based proxy network. By embedding malicious code—often masquerading as legitimate software—into Android-based streaming devices and smart TVs, the operators of NetNut created a global relay system.
When a consumer purchases an inexpensive, non-branded streaming box, they are often unknowingly activating a “bridge” into their own home network. Once the NetNut SDK is active, the device begins routing third-party traffic. This traffic is frequently malicious. For a cybercriminal, the primary value of a residential proxy is its "reputation." Traffic originating from a residential ISP is far less likely to be blocked by security filters than traffic originating from a known data center.
Google’s Threat Intelligence Group (GTIG) observed that during a single week in June 2026, there were 316 distinct clusters of threat actors leveraging NetNut exit nodes. According to Google, these actors utilized the service to mask their origin IP addresses, conduct password-spraying attacks against corporate environments, and circumvent geofencing. Perhaps most concerning is the collateral damage to the end-user: by turning a TV box into a proxy node, the operators opened a window into the user’s private home network, exposing other connected devices—such as laptops, phones, and smart home controllers—to external threats.
Official Responses and Corporate Liability
The fallout from the seizure has placed Alarum Technologies under immense legal and regulatory pressure. Omer Weiss, legal counsel for the firm, issued a statement following the initial seizure, confirming the company’s awareness of the federal action.
"Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account," Weiss stated.
However, the scale of the operation suggests that "misuse" was a core, rather than incidental, feature of the business model. Industry partners cited in the seizure notice—including Google, Lumen, and Shadowserver—have provided the intelligence necessary to dismantle the backend systems that made the NetNut network functional. Google, in particular, has taken the additional step of purging apps from its ecosystem that were found to bundle the NetNut SDKs, effectively cutting off the supply chain for new botnet recruits.
The Broader Implications for Cyber Resilience
Benjamin Brundage, founder of the proxy tracking service Synthient, suggests that the takedown of NetNut will create a significant vacuum in the cybercrime economy. According to Brundage, NetNut had become the premier service for malicious actors following the earlier takedown of its competitor, IPIDEA.
"I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown," Brundage noted. "They were on par with IPIDEA in terms of daily traffic, quality, and scale. Their demise is a massive blow to the infrastructure of the cybercrime community."
Beyond the disruption of individual proxy services, there is the lingering issue of Distributed Denial-of-Service (DDoS) attacks. Earlier this year, Synthient exposed the Kimwolf botnet, which utilized similar proxy tunneling techniques to infect Android-based devices behind home firewalls. The dismantling of the Popa/NetNut infrastructure is expected to hinder the growth of such botnets, as the available pool of "rentable" home devices shrinks.
However, experts caution against premature celebration. The residential proxy market is highly fluid. As seen with the aftermath of the IPIDEA takedown, many of these organizations simply pivot to becoming resellers of other, smaller, or less-regulated networks. "Google has high confidence that many popular residential proxy brands are in fact white-labeling the NetNut botnet," the GTIG report warned. "Individual networks can appear resilient because they simply buy capacity from competitors."
Protecting the Consumer: A Call for Caution
The investigation underscores a harsh reality for the modern consumer: the “smart” device in the living room may be a liability. The devices most frequently commandeered for the Popa botnet are those that do not utilize Google’s official Android TV OS or those that have been modified to run unauthorized, off-market operating systems.
Research from Spur.us has further highlighted the depth of the infection. Their recent analysis found that 42 percent of apps available for the LG webOS platform included SDKs that transformed the television into an always-on proxy node. Samsung’s Tizen operating system faced similar findings, with over a quarter of apps containing residential proxy components.
For the average consumer, the path to protection is clear but requires diligence:
- Stick to reputable brands: Avoid off-brand, cheap streaming boxes sold on major e-commerce platforms that lack official certification.
- Verify Play Protect: Use the official Google Play Store and ensure that the device is Play Protect certified.
- Exercise app discipline: Be highly selective about the applications installed on smart TVs. If an app is not from a trusted, well-known developer, it may be harboring unauthorized proxy SDKs.
As law enforcement continues to peel back the layers of the residential proxy industry, the NetNut seizure serves as a warning to both the operators of these networks and the consumers who unwittingly host them. The "always-on" nature of modern home electronics has created a fertile, yet vulnerable, landscape that requires both federal intervention and individual vigilance to secure. Whether this disruption will lead to a fundamental shift in the industry or merely a reshuffling of the players remains to be seen, but for now, the digital infrastructure of the Popa botnet lies in tatters.
