Google and FBI Dismantle Massive Cyber Network Controlling Millions of Devices

Google, in collaboration with the FBI and other law enforcement agencies, announced over the weekend the takedown of the NetNut cyber network, which was also linked to the Popa botnet. According to reports from c14, this network controlled at least 2 million infected devices worldwide, including smart TVs, streaming boxes, and Android devices, turning them into exit nodes for malicious internet traffic. This allowed cybercriminals to conduct attacks while hiding behind the IP addresses of unsuspecting home users, making the attacks appear as if they originated from ordinary households rather than hacker infrastructure. This significantly complicated real-time identification of attack sources by security firms, ISPs, and organizations.

Google revealed that some devices were infected with malware even before reaching consumers, while others were compromised through trojanized apps installed by users. Google Play Protect detected and blocked these infected apps and alerted users whose devices were affected. The network was used for password spraying attacks targeting numerous accounts with common passwords, bypassing geographic restrictions, and attempting breaches into corporate environments using seemingly legitimate IP addresses.

As part of the operation, the FBI seized key domains used by the network, including netnut.com. Concurrently, Google disabled accounts and cloud services used by the network operators for command and control, severing communication between the central infrastructure and infected devices and delivering a significant blow to the network. Google emphasized that the fight against such threats continues, sharing technical data with security researchers and platform providers to prevent the network's reestablishment under different names. This operation highlights the ongoing risks posed by unsecured smart devices, which can be exploited by cybercriminals without owners' knowledge.