Google disrupts NetNut proxy network used in malware operations

Lumen Technologies

02/07/2026 19:06

July 2 (Reuters) - Alphabet's GOOGL.O Google said on Thursday it weakened a large network of internet-connected devices that was being used to hide and route malicious online activity.  
The tech giant said it took action against the NetNut residential proxy network, also known as Popa, in partnership with the FBI and Lumen LUMN.N, among others.
Google said it disabled accounts and services used in NetNut-related malware command-and-control operations and shared technical intelligence on the group's infrastructure with law enforcement and industry partners to support broader enforcement efforts.
Residential proxy networks allow users to route internet traffic through consumer IP addresses, which can mask the origin of online activity and help bypass security defenses. Such networks can be used for legitimate purposes, but they are also often abused for cybercrime because they obscure the true source of traffic.
"We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions," Google said in a blog.
     NetNut offers rotating residential, ISP, mobile, and datacenter proxies. It was founded in 2017 as a subsidiary of Alarum Technologies, a cybersecurity firm in Israel.

 (Reporting by Juby Babu in Mexico City; Editing by Tasim Zahid)
 ((Juby.Babu@thomsonreuters.com;))