Somewhere in a spare bedroom, a router has been secretly moonlighting as a getaway car for cybercriminals since who-knows-when. This week, Google and the FBI finally repossessed the fleet.

Two Million Devices, One Very Awkward Unmasking

The FBI and Google's Threat Intelligence Group, working with Lumen Technologies, the Shadowserver Foundation, and the IRS Criminal Investigation division, dismantled NetNut, one of the world's largest commercial residential proxy networks. The coordinated international operation seized hundreds of domains underpinning the service. GTIG estimates the botnet spanned at least 2 million devices scattered across the globe — meaning ordinary home routers and gadgets were quietly routing traffic for people who were very much not their owners.

In just one week of June, GTIG says it observed 316 distinct threat clusters riding NetNut's exit nodes, a mix of run-of-the-mill cybercriminals and full-on espionage operations, all using the network to mask their real location while breaking into other people's systems and running password-spray attacks.

The Proxy Business Was Legit-Looking, Which Was the Whole Problem

NetNut is linked to Alarum Technologies, a Nasdaq-listed Israeli company, whose legal counsel says it's cooperating with investigators to sort out "any misuse of its infrastructure." That's the uncomfortable part of this story: residential proxy networks sell themselves as legitimate infrastructure for ad verification and market research, complete with white-label reseller programs so other brands can resell the same pool of IPs under their own name. It's a real business model with a real customer base — which is exactly what makes it such convenient camouflage for attackers who want to look like they're browsing from someone's living room instead of a server farm.

The bigger picture most headlines skip: this is Google's second major residential-proxy disruption in recent memory, suggesting these networks have quietly become the plumbing of choice for both ransomware crews and nation-state operators alike — a shared utility hiding in plain sight, priced by the gigabyte.

Two million zombified devices is a lot of unwitting accomplices for a service most of them never signed up for in the first place.

Source: The Register