The NetNut Botnet Case Shows the Rot Beneath the “Residential Proxy” Market

The NetNut situation should not be treated as just another cybercrime takedown. It is a warning about a fast-growing internet gray market in which ordinary people’s home devices—TV boxes, smart TVs, routers, streaming hardware, and apps—can quietly become infrastructure for someone else’s business model.

On July 2, 2026, Google said it had coordinated with the FBI, Lumen, Shadowserver, and others to disrupt the NetNut residential proxy network, also known by researchers as Popa. Google estimated the network at at least two million devices worldwide and said it had disabled Google accounts and services used for malware command-and-control, shared intelligence with enforcement partners, and used Play Protect to warn users and disable apps known to incorporate NetNut SDKs.

The most disturbing part is not only the scale. It is the business logic. Residential proxy networks sell access to real household IP addresses so traffic looks as if it is coming from normal homes rather than suspicious servers. There can be legitimate uses for proxies, including testing, privacy, and web access management. But when the “supply” comes from devices enrolled without meaningful consent, the model begins to look less like infrastructure and more like laundering: laundering traffic, laundering risk, and laundering responsibility.

According to Google, threat actors used suspected NetNut exit nodes for activity including accessing victim environments, reaching their own infrastructure, and password-spray attacks. In one week in June 2026, Google said it observed 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups. That means the victim is not only the company being attacked. The victim may also be the household whose internet connection becomes the disguise.

This is why the NetNut case matters beyond NetNut. The modern botnet is no longer always a shadowy collection of infected desktop computers. It may be embedded in cheap connected devices, bundled in software development kits, or hidden behind the language of “unused bandwidth.” Consumers are invited to monetize a resource they barely understand, while attackers gain a mask that is difficult for defenders to block without also blocking real people.

The FBI reportedly seized hundreds of domains associated with NetNut, a proxy service operated by Alarum Technologies’ subsidiary NetNut Ltd., after multiple security firms connected NetNut to the Popa botnet. KrebsOnSecurity reported that the compromised device pool included at least two million devices and that NetNut software turned systems such as smart TVs and streaming boxes into always-on residential proxy nodes rented to others for abusive traffic such as scraping, ad fraud, and account takeover activity.

Alarum has not admitted wrongdoing. In its July 3 update, the company said it became aware that certain NetNut-associated domains had been seized by the FBI, that additional domains had also been seized, and that it was experiencing disruption to part of its services. It also said it was investigating whether its network or services had been used for malicious, fraudulent, or unlawful purposes by third parties and would cooperate with law enforcement. That distinction matters: allegations, investigations, and enforcement actions are not the same as final legal findings.

Still, the wider lesson is already visible. Residential proxy networks create an accountability gap. Customers can say they merely bought access. Providers can say customers misused the service. App developers can say users accepted the terms. Device makers can say they only shipped the hardware. Meanwhile, the person at home pays the broadband bill, absorbs the reputational risk, and may never know their IP address was used as a shield for someone else’s attack.

The industry’s favorite defense is that proxies are neutral technology. That is partly true—and mostly insufficient. Cars are neutral technology too, but we still require license plates, insurance, safety standards, recalls, and liability. If a commercial proxy network depends on millions of residential endpoints, it should be able to prove where those endpoints came from, how consent was obtained, how abuse is detected, and how users can opt out. “We are only a platform” is not enough when the platform’s raw material is other people’s living rooms.

Google also warned that the problem is resilient because proxy providers can buy capacity from competitors and become resellers, meaning one takedown may simply push demand into neighboring networks. That is the real challenge. Enforcement can seize domains, app stores can remove bad software, and security firms can publish indicators. But unless the economics change, the market will regenerate.

The NetNut case should push regulators, app stores, device makers, and broadband providers toward a simple principle: no residential proxy network should operate at scale without auditable consent and traceable supply. Apps that turn devices into exit nodes should disclose that fact in plain language, not bury it in legal fog. Smart TV and streaming-device ecosystems should treat hidden proxy SDKs as a security risk, not a quirky monetization feature. Public companies selling proxy infrastructure should face investor-grade disclosure obligations when their networks are alleged to overlap with botnets.

Consumers should also take the hint. Be suspicious of apps that pay for “unused bandwidth,” avoid unofficial streaming boxes and uncertified Android devices, keep Play Protect or equivalent protections enabled, and remove apps that promise money for sharing internet access. Google specifically warned that these offers are a primary way malicious proxy networks grow.

But this cannot be solved by telling ordinary users to read more fine print. The internet has spent years pushing risk outward—to the customer, the user, the home, the small business—while monetization moves inward to platforms and intermediaries. The NetNut situation is a reminder that cybersecurity is not only about malware. It is about incentives.

A botnet of two million devices does not appear out of nowhere. It grows where devices are cheap, software supply chains are opaque, enforcement is slow, and data-hungry customers are willing to pay for access without asking too many questions. The takedown may be a win. But the real test is whether the proxy economy learns that “residential” should mean human consent—not human camouflage.