[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYJEH2HJI29mhmJf5OYnFzw8KNdVFyCrlo4uOqPPufbw":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"854c0c09-8fc1-4965-9070-12961ea84aa9","FBI Seizes NetNut Proxy Platform, Popa Botnet","fbi-seizes-netnut-proxy-platform-popa-botnet-417bda","The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.","The FBI, with industry partners, has seized hundreds of domains associated with NetNut, a residential proxy service operated by Alarum Technologies. This action follows reports linking NetNut to the Popa botnet, which compromised millions of devices. The NetNut service turned compromised devices into proxy nodes rented by cybercriminals for activities like scraping, fraud, and account takeovers, while also exposing home networks to threats.","FBI seizes hundreds of domains linked to NetNut proxy service and Popa botnet.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F07\u002Ffbi-seizes-netnut-proxy-platform-popa-botnet\u002F","https:\u002F\u002Fkrebsonsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fnetnutseizure.png","2026-07-02T19:27:33+00:00","2026-07-02T20:00:16.994621+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Popa botnet","threat_actor",{"name":21,"type":22},"Alarum Technologies","vendor",{"name":24,"type":25},"NetNut","product",{"name":27,"type":22},"Google",{"name":29,"type":30},"residential proxy service","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":51,"value":18,"context":56},"Malicious software compromising devices and used by NetNut",[27,21,24],{"controls":59,"vendors":137},[60,81,110],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[65,73],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":82,"name":83,"problem":84,"products":85},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":111,"name":112,"problem":113,"products":114},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[115,121,129],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",[138],{"slug":139,"name":27,"logo_path":140,"roles":141},"google","\u002Fvendor-logos\u002Fgoogle.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":157},"fbi-seizes-botnet-backed-residential-proxy-network-exploiting-millions-of-devices","FBI Seizes Botnet-Backed Residential Proxy Network Exploiting Millions of Devices","The Popa botnet silently compromised millions of consumer devices and enrolled them as proxy nodes in the NetNut service, monetizing unwitting victims' bandwidth and home networks for criminal activity. The root problem is a widespread lack of device-level security awareness and visibility — most affected users had no idea their routers or IoT devices had been hijacked. This matters because compromised residential proxies are highly trusted by fraud detection systems, making them a premium tool for account takeovers, ad fraud, and scraping attacks. When home devices are weaponized at scale, the downstream harm extends far beyond the device owner to businesses and individuals targeted by the criminal customers renting those proxies.",[148,149,150,151,152,153,154,155,156],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-115 – Technical Guide to Information Security Testing","NIST IR 8228 – IoT Cybersecurity Risk Management","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","GDPR Article 32 – Security of Processing (for EU-affected device owners)","ITIL – Event Management (monitoring for anomalous device behavior)",{}]