As cited
Copy frozen at (site build).
threat intel
FBI Seizes NetNut Proxy Platform, Popa Botnet
The FBI seized hundreds of domains associated with NetNut, a residential proxy service operated by Israeli company Alarum Technologies, which was connected to the Popa botnet comprising at least two million compromised devices. The action followed security research linking NetNut's infrastructure to the botnet, which was used by threat actors for credential attacks, content scraping, advertising fraud, and masking malicious traffic origins. Google and other industry partners assisted in the takedown, disabling NetNut's command and control infrastructure and apps bundling its software.
Why it matters: Security teams and threat hunters should monitor for customer exposure to NetNut proxy services and verify whether their organizations or vendors were relying on NetNut infrastructure for legitimate purposes, as the takedown disrupts a widely-used proxy service that cybercriminals exploited to obfuscate attack traffic.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
FBI Seizes NetNut Proxy Platform, Popa Botnet
The FBI seized hundreds of domains associated with NetNut, a residential proxy service operated by Israeli company Alarum Technologies, which was connected to the Popa botnet comprising at least two million compromised devices. The action followed security research linking NetNut's infrastructure to the botnet, which was used by threat actors for credential attacks, content scraping, advertising fraud, and masking malicious traffic origins. Google and other industry partners assisted in the takedown, disabling NetNut's command and control infrastructure and apps bundling its software.
Why it matters: Security teams and threat hunters should monitor for customer exposure to NetNut proxy services and verify whether their organizations or vendors were relying on NetNut infrastructure for legitimate purposes, as the takedown disrupts a widely-used proxy service that cybercriminals exploited to obfuscate attack traffic.
- Source published
- First seen by Cybersecurity Tracker