In a coordinated operation announced Thursday, Google, the FBI, Lumen Technologies, the Shadowserver Foundation, and other partners took action to significantly degrade NetNut, a residential proxy network that had enrolled at least two million consumer devices into its infrastructure. The disruption marks the second major operation of its kind this year — following January's takedown of IPIDEA, then described as the world's largest residential proxy network — and signals that the coalition is building a playbook for dismantling the infrastructure that cybercriminals rely on to hide their tracks.

Understanding the target requires a brief detour into how residential proxy networks function. Unlike traditional VPNs or datacenter proxies, residential proxies route traffic through actual home internet connections. To a website or security system, the traffic looks like it's coming from a real person in a real household — not a data center, not a known anonymization service. For cybercriminals, this is gold: it lets them conduct credential-stuffing attacks, scrape protected content, spread misinformation, and access compromised environments without triggering the geographic or behavioral anomaly detectors that would flag traffic from a server farm. NetNut built its pool of residential IPs by distributing an SDK through small TV-streaming hardware devices, quietly enrolling them into its proxy network — often without meaningful transparency to the people who owned those devices.

Google's Threat Intelligence Group (GTIG) reported that in a single week during June 2026, they observed 316 distinct threat clusters using suspected NetNut exit nodes. These ranged from financially motivated cybercriminal groups conducting password-spraying attacks to state-linked espionage actors using the proxy network to obscure their origin when accessing victim environments. The sheer diversity of threat actors — spanning the entire spectrum from low-level fraud to advanced persistent threats — illustrates why residential proxy networks have become such a high-priority target for the defenders.

What makes this story bigger than a single botnet takedown is that it exposes the structural economics of the residential proxy market. NetNut wasn't just a proxy service — it offered a reseller program, and GTIG believes multiple other residential proxy brands were effectively white-labeling NetNut's infrastructure. When you disrupt the upstream provider, you disrupt an entire downstream ecosystem. But the challenge works both ways: after January's IPIDEA disruption, GTIG observed that disrupted proxy operators simply started buying capacity from their competitors, effectively becoming resellers themselves. The market is fluid and adaptive. Disrupt one network and the demand doesn't vanish — it migrates.

This is where one original insight comes into focus: the coalition isn't just playing whac-a-mole — they're executing a market-consolidation attack. Every time a major proxy network is degraded, the remaining competitors see a spike in demand. But each operation also generates intelligence about which networks are interconnected, who the resellers are, and where the infrastructure dependencies lie. GTIG's own language — "we must scale our efforts to target the infrastructure of several interconnected providers" — strongly suggests they are mapping the supply chain with the goal of disrupting enough nodes simultaneously to create genuine scarcity, not just temporary displacement. It's the counter-infrastructure equivalent of going after an organized crime network not by arresting one boss, but by simultaneously hitting every lieutenant until the organization can't reconstitute itself.

A second original angle worth exploring is the legitimacy grey zone that makes residential proxies uniquely hard to regulate. The pitch that NetNut and its peers used — "monetize your spare bandwidth" — is indistinguishable from the value proposition of perfectly legal services like Honeygain, PacketStream, and EarnApp. These companies pay users a few dollars a month to run software that shares their internet connection, and the services are then sold for market research, ad verification, and price comparison. From a consumer's perspective, there is no practical way to distinguish between a legitimate bandwidth-sharing app and a botnet SDK. Both ask for the same permissions. Both run in the background. Both route traffic. The difference is entirely in the downstream customer, which the end user never sees. When Google says the long-term solution requires support from ISPs, mobile platforms, and technology companies, this is what they're pointing at: a policy and detection problem, not just an enforcement problem.

The NetNut operation also reveals an uncomfortable truth about the hardware supply chain. GTIG found plugin components for large-scale botnet families like Badbox 2.0, and public reports have linked NetNut to Mirai variant infections. Badbox 2.0 is particularly notable — it's a fraud operation that ships compromised, low-cost Android TV boxes and other streaming devices pre-loaded with malware. The fact that NetNut's SDK was distributed "mainly through small TV-streaming hardware" is not a coincidence. These devices occupy a regulatory blind spot: they're too cheap to attract serious security scrutiny from their manufacturers, too obscure for most consumers to think about patching, and too connected to leave offline.

The FBI's involvement is also worth a closer look. The netnut.com domain now displays a seizure notice, but notably, netnut.io remains online. This discrepancy — which The Register highlighted and GTIG did not immediately explain — hints at the jurisdictional complexity of these operations. .com domains fall under US jurisdiction via Verisign. .io domains are administered by a UK-based company (Internet Computer Bureau) and subject to different legal processes. It's a reminder that even a well-coordinated multi-agency operation hits friction at the borders of the internet's fragmented governance.

Google's blog post on the disruption frames this as a continuation of a deliberate, strategic campaign rather than a one-off victory. The company explicitly states that "creating a lasting disruption in this fluid ecosystem means we must scale our efforts," language that reads less like a press release and more like a mission statement. Combined with January's IPIDEA takedown, a pattern is emerging: major residential proxy networks are being targeted at a cadence of roughly one every six months. If the coalition can sustain that pace — and if each operation yields actionable intelligence about the next target — the residential proxy market could face genuine structural pressure for the first time since it emerged as a commercial industry.

For everyday internet users, the practical takeaway is straightforward but important: be extremely skeptical of any app or service that offers to pay you for your unused bandwidth. The few dollars a month you might earn pale in comparison to the risk of your IP address being used for credential theft, espionage, or worse. More broadly, the NetNut disruption is evidence that the public-private partnership model in cybersecurity — where tech platforms contribute intelligence, threat research, and technical capabilities alongside law enforcement's legal authorities — is maturing into a repeatable framework. It's not a silver bullet, and the adaptive nature of the proxy market means the fight is far from over. But two major disruptions in six months is a signal that the good guys are learning to move at the speed of the threat.

Sources: - NetNut cracked as Google and FBI target 2 million-device botnet — The Register (Connor Jones) - Google's Continued Disruption of Malicious Residential Proxy Networks — Google Cloud Blog - FBI Seizes NetNut Proxy Platform, Popa Botnet — Krebs on Security - Disrupting the World's Largest Residential Proxy Network (IPIDEA) — Google Cloud Blog (January 2026)