NetNut Residential Proxy Botnet Disruption
First seen Jul 5, 2026 · Updated Jul 5, 2026
A joint law enforcement and industry operation involving Google disrupted NetNut, a residential proxy network built on approximately 2 million compromised Android devices, including smart TVs and streaming boxes. The infrastructure allowed threat actors and paying customers to route traffic through unwitting victims' devices, enabling anonymized malicious activity such as credential stuffing, ad fraud, and scraping. The takedown cuts off access to this proxy pool but does not necessarily remediate infections on affected devices.
Technical Analysis
NetNut operated as a residential proxy-as-a-service platform, monetizing access to malware-infected Android-based devices (smart TVs, streaming boxes, and other IoT endpoints) that lacked traditional endpoint protections and rarely received security patches. Infected devices likely ran backdoor or SDK-based malware embedded in sideloaded apps or third-party firmware, granting the proxy network operator persistent outbound connectivity abused to relay traffic for anonymization purposes. Because residential proxy networks are frequently used to mask credential-stuffing and API abuse traffic as legitimate consumer IP addresses, this infrastructure could have been leveraged to disguise automated attacks against cloud services, including those exposing LLM or agent APIs, complicating IP-based rate-limiting and anomaly detection. Organizations running AI agents that rely on external API calls or web-scraping/RAG pipelines should verify whether inbound traffic patterns previously flagged as anomalous correlated with NetNut proxy IP ranges, as such traffic could have been used to probe or abuse agent-facing endpoints while evading geographic and reputation-based blocklists.
Affected Systems
Android-based smart TVs, streaming boxes, and other Android IoT devices infected with proxy-enabling malware; downstream services/APIs that received traffic routed through the NetNut residential proxy pool
Indicators of Compromise
- No specific hashes, IPs, or domains disclosed in source reporting
Remediation Steps
- 1
Audit smart TV and streaming box firmware
Check installed apps and firmware versions on Android-based smart TVs and streaming devices for unauthorized or unknown applications; factory reset and update firmware where compromise is suspected.
- 2
Review proxy/VPN traffic in security logs
Cross-reference historical inbound traffic logs against known residential proxy IP reputation lists to identify past abuse of exposed APIs or agent endpoints.
- 3
Strengthen bot and proxy detection
Implement behavioral and device-fingerprinting-based bot detection rather than relying solely on IP reputation, since residential proxies mimic legitimate consumer traffic.
- 4
Restrict sideloading on IoT/TV devices
Disable installation of apps from unverified sources on Android TV and streaming devices to reduce reinfection risk.
- 5
Monitor for API abuse patterns
For organizations exposing agent or LLM APIs, monitor for distributed low-volume request patterns consistent with residential proxy abuse, which can bypass simple rate-limiting.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.