general · TheHackerNews
Google's Threat Intelligence Group, working with the FBI, Lumen, and others, has significantly degraded NetNut (also tracked as Popa), a residential proxy network estimated to span at least 2 million compromised home devices including smart TVs and streaming boxes. The network allows attackers to rent access to real residential internet addresses, routing malicious traffic through compromised home connections so attacks appear to originate from ordinary users rather than data centers. NetNut traces to Alarum Technologies, a publicly traded Israeli company, though Alarum disputes the "botnet" label and claims its software enables consented bandwidth-sharing. Researchers at Qurium, Synthient, Nokia Deepfield, and Spur demonstrated that traffic sent through NetNut's commercial gateway exited through enrolled Popa devices, and found that over 20 apps examined did not display user consent prompts. In June alone, Google identified 316 distinct threat clusters—including cybercriminal and espionage groups—using suspected NetNut exit nodes for password-guessing attacks and to conceal their locations.
For regulated organizations, this incident underscores supply-chain and third-party risk exposure relevant to NIST 800-171, CMMC, and SOC2 compliance frameworks. Defense contractors handling CUI and SaaS firms subject to SOC2 Type II audits should assess whether employees or network infrastructure inadvertently host compromised devices that could provide attackers a foothold into internal systems. Healthcare providers and fintechs relying on HIPAA and PCI DSS controls should similarly evaluate residential device deployments and enforce endpoint detection policies that identify suspicious bandwidth consumption or unauthorized proxy behavior. An Omniware engagement can scope third-party device inventory, assess data exfiltration risks from compromised exit nodes on corporate networks, and recommend monitoring strategies aligned with your compliance obligations.
Source: The Hacker News - https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html
Source: TheHackerNews
All briefings