FBI Seizes NetNut Proxy Platform and Popa Botnet

The Corporate Botnet Hiding in Plain Sight

On July 2, 2026, the FBI and IRS Criminal Investigation seized hundreds of domains associated with NetNut, a massive residential proxy service. The homepage of NetNut was replaced with a stark government seizure banner. This was not a standard hacker takedown. NetNut is operated by Alarum Technologies, a publicly-traded Israeli company listed on NASDAQ under the ticker ALAR.

Security researchers connected NetNut directly to the Popa botnet, a sprawling network of over two million compromised consumer devices. These were not high-end servers. They were smart TVs, streaming boxes, and cheap Android media players sitting in living rooms worldwide. The malware quietly turned these devices into always-on proxy nodes, routing abusive internet traffic under the guise of legitimate residential users.

Your smart TV has an open port. While you slept, your streaming box was renting out your home internet connection to the highest bidder. No one cares about your movie watchlist. They care about your residential IP address.

The scale of the abuse is staggering. The Google Threat Intelligence Group reported observing 316 distinct threat actor clusters, including cybercriminal syndicates and state-sponsored espionage groups, using NetNut exit nodes in a single week in June 2026. This is not a legitimate business. It is a corporate-sanctioned cyber weapon.

How Popa Hijacks Your Living Room Firmware

Popa operates as a stealth communications layer. It does not destroy files or lock screens with ransomware. It does not need to. Instead, it quietly installs itself as a software development kit (SDK) inside seemingly benign apps, or comes pre-flashed in the firmware of cheap, unbranded Android TV boxes sold online. Once installed, it establishes a persistent, encrypted tunnel back to its command and control servers.

The malware exploits outdated operating systems and unpatched firmware vulnerabilities. A simple buffer overflow in a poorly coded media player app is all it takes to gain root access. From there, the botnet controller can push updates, monitor local network metadata, or even deploy a keylogger if they want to expand their footprint. Because these devices are plugged in and connected to the internet 24/7, they provide a highly stable, permanent proxy infrastructure.

Attackers use these residential nodes to bypass traditional security filters. When a cybercriminal launches a credential stuffing attack, a standard data center IP gets blocked instantly. But when the attack traffic is routed through a family's smart TV in Ohio, it looks like legitimate home user activity. The security systems are fooled, and your home network becomes the launchpad for an account takeover.

Your opsec is compromised the moment you plug these unvetted devices into your primary network. If you have not segregated your IoT hardware, you are inviting attackers into your private digital space.

The NASDAQ Connection: Monetizing the Hijacked Web

The most disturbing aspect of this operation is the corporate veneer. Alarum Technologies is not a shadow group operating out of a hidden forum. It is a publicly-traded entity. After the seizure, Alarum issued statements pledging full cooperation with law enforcement and claiming they are investigating whether third parties misused their network. This is a classic corporate deflection.

A few weeks before the seizure, KrebsOnSecurity published findings from multiple security firms that connected NetNut's backend infrastructure directly to the Popa botnet's control mechanisms. You do not accidentally build a two-million-device botnet out of hijacked smart TVs. The residential proxy industry has long operated on a wink-and-a-nod business model, buying traffic from malware developers and selling it to corporate clients as web intelligence.

It is time to end the double standard. If a teenager builds a botnet to launch DDoS attacks, they go to federal prison. If a publicly-traded company builds a botnet to route malicious traffic and calls it a residential proxy network, they get investor funding and a NASDAQ listing. We must start prosecuting the executives who profit from the systematic compromise of consumer hardware.

The money trail is clear. Alarum reported millions in revenue from its NetNut division, built entirely on the backs of consumers who never consented to having their home bandwidth sold to spies and fraudsters.

Mitigation and Digital Sovereignty

You cannot rely on device manufacturers to protect you. Most smart TVs run outdated Android forks that will never receive a security patch. Your only defense is network-level segregation. Put every smart TV, streaming box, and IoT device on a dedicated guest network or a separate VLAN. Do not let them talk to your personal computers or local storage drives.

Monitor your router's outbound traffic. Look for persistent, encrypted connections to unfamiliar IP addresses. If a streaming box is uploading gigabytes of data when you are not even watching TV, it is a proxy node. Turn it off. Do not wait for a software update that may never come.

Stop buying cheap, unbranded streaming sticks from online marketplaces. They are cheap for a reason. The hardware is subsidized by the malware pre-installed in the factory firmware. Stick to reputable platforms, and even then, audit their network permissions.