Google researchers dismantle NetNut, a malicious proxy network with 2 million compromised devices

Google cybersecurity researchers, along with the FBI and industry partners, have dismantled one of the largest malicious residential proxy networks globally, known as NetNutwhich managed to compromise 2 million home devices.

NetNut, too known as Popais one of the most popular ‘proxy’ networks currently, which is characterized by allow cybercriminals to hide their malicious activities under legitimate IP addresses when launching their attacks, specifically, selling the ability to route traffic through IP addresses owned by internet service providers.

This proxy network had compromised at least two million devices globally, including from streaming devices to Smart TVwhich were infected through Trojanized applications and botnets such as Badbox 2.0, where malicious actors packaged hidden proxy plugins.

However, the Google Threat Intelligence Group (GTIG), hand in hand with the FBI, Lumen and other organizations in the sector, they have managed to take measures against the NetNut networkdismantling it and directly impacting its individual operations.

This was shared by the company in a statement on its security blog, where it noted that this strategic blow joins the dismantling of the IPIDEA proxy network at the beginning of the year, reinforcing the technology company’s commitment to dismantling proxy botnets.

As Google has shared, during its investigation, in just one week Last June they identified up to 316 different threat groups operating on this NetNut network, spanning from common cybercrime to cyberespionage actors. These malicious actors used users’ devices and the network to hide their source IP addresses, launch brute force attacks and access victims’ environments.

Therefore, with an infected device, cybercriminals converted the users’ home hardware into “exit nodes”, further exposing their broader Internet networks and causing the operators (ISPs) will mistakenly block or flag legitimate traffic as suspicious of said homes.

To stop these malicious activities, Google has gone after the NetNut network, dismantling its infrastructure by disabling of technology accounts and serviceswhich NetNut exploited for the command and control (C2) tasks of the ‘malware’. This allowed cease your critical backend infrastructureas they have assured.

Likewise, they have also introduced protection measures for the ecosystem. Through Google Play Protect, has been automatically disabled infected software on victims’ devices and they have been alerted about this security incident with automatic notifications.

To prevent a continuation of this ‘proxy’ network, Google has also shared your data obtained from technical intelligence with other platform providers, investigation firms and other law enforcement agencies. Specifically, they have shared data collected on NetNut’s software development kits (SDK) and bakend’s command and control (C2) infrastructure.

“While one-time outages are a critical tool to protect our users, a continued and coordinated effort is needed to reduce malicious proxy networks in the long term,” Google stressed, while encouraging the mobile platforms, Internet providers and other platforms to “continue sharing information and take direct action.”