Google Degrades NetNut 2M-Device Proxy Network Tied to Alarum's Public Operations

Google's action targeted NetNut, also called Popa, which routes attacker traffic through compromised home routers and IoT devices to mask origins. In June, 316 threat clusters used its nodes for credential stuffing and espionage. The network overlaps with Mirai and Badbox 2.0 infrastructure, giving exit nodes direct internal network access once traffic is accepted. Synthient and Qurium traced live traffic from NetNut's commercial gateway to devices enrolled in Popa, confirming the shared pool. None of 20 examined apps displayed consent prompts. Alarum Technologies, the NASDAQ-listed owner, denies botnet involvement but operates a reseller program that rebrands the same nodes under independent labels. This fits the pattern seen after the January IPIDEA takedown: operators lease capacity from rivals to rebuild. NetNut's design, with pre-installed firmware on cheap hardware, makes full eradication unlikely without simultaneous pressure on multiple providers and the supply chain of affected devices. Future operations will require coordinated hits on reseller networks and firmware vendors rather than single-provider disruptions. Consumer devices enrolled without visible consent remain the persistent weak point.