{"rewrite":{"id":"r_901c9e5268901f91108ca659","clusterId":"c_67e5a122e123fb4c41ec419f","slug":"fbi-and-google-dismantle-netnut-botnet-hijacking-2-million-devices","model":"deepseek-v4-flash","headline":"FBI and Google Dismantle NetNut Botnet Hijacking 2 Million Devices","summary":"The FBI and Google disrupted the NetNut residential proxy network, which incorporated over 2 million consumer devices including smart TVs and streaming boxes as exit nodes for cybercriminals and state-sponsored attackers. The takedown involved domain seizures, account disabling, and technical countermeasures with Lumen.","whyItMatters":"The coordinated action significantly weakened a major proxy network that let attackers hide malicious traffic behind ordinary home IP addresses, reducing the pool of hijacked devices available for cyber operations.","webCardHtml":"\u003cp\u003eThe botnet NetNut turned cheap Android smart TVs, streaming media boxes, and unofficial apps like SmartTube into relay nodes for cybercriminals. The incorporated devices served as exit nodes, making attacks appear to originate from ordinary households. Google Threat Intelligence reported that in a single week in June 2026, at least 316 threat clusters used NetNut for password spraying, credential stuffing, ad fraud, and data scraping.\u003c/p\u003e\u003cp\u003eThe FBI seized domains tied to NetNut on July 2, 2026, and notified parent company Alarum Technologies. Google disabled accounts NetNut used for command and control, shared infrastructure details with law enforcement, and used Play Protect to warn users about apps containing the problematic SDK. The company said the joint action has significantly weakened NetNut\u0026#39;s network, reducing the pool of available devices by millions. The takedown follows a similar disruption of the IPIDEA proxy network in January 2026.\u003c/p\u003e","blueskyPost":"The FBI and Google took down NetNut, a residential proxy network that hijacked over 2 million smart TVs and other devices for cyberattacks. The joint action weakened the botnet used by criminals and state actors.","twitterPost":"The FBI and Google disrupted NetNut, a residential proxy network that hijacked over 2 million smart TVs and devices. The botnet was used for password spraying, credential stuffing, and ad fraud. The action significantly reduced the available hijacked devices.","threadsPost":null,"newsletterBlurb":"The FBI and Google disrupted the NetNut residential proxy network, which had incorporated over 2 million consumer devices as exit nodes for cybercriminal and state-sponsored attacks. The coordinated action included domain seizures, account disabling, and technical countermeasures, significantly weakening the network.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20260710-fbi-google-netnut-botnet-smart-tv/\",\"title\":\"FBI and Google Bust Botnet 'NetNut' That Hijacked Over 2 Million Smart TVs and Other Devices\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4157,"outputTokens":1279,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1783634608,"createdAt":"2026-07-09T21:54:00.000Z","publishedAt":"2026-07-09T21:57:28.000Z","updatedAt":"2026-07-09T21:54:00.000Z"},"cluster":{"id":"c_67e5a122e123fb4c41ec419f","canonicalTitle":"FBIとGoogleがスマートテレビなど200万台超を乗っ取ったボットネット「NetNut」を摘発","representativeArticleId":"a_f159c2fd8fb29082c96719bb","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-07-09T21:00:00.000Z","lastSeenAt":"2026-07-09T21:00:00.000Z","updatedAt":"2026-07-09T21:57:29.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20260710-fbi-google-netnut-botnet-smart-tv/","title":"FBIとGoogleがスマートテレビなど200万台超を乗っ取ったボットネット「NetNut」を摘発"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}