The Botnet Was the Supply Chain

The NetNut/Popa disruption is not just a botnet story. It is a test of whether defenders can raise the cost of criminal residential-proxy capacity faster than the market can reroute.

The NetNut/Popa disruption is not just a botnet story.

It is a capacity story.

Attackers do not need NetNut specifically. They need residential egress that still works: clean-looking IPs, geographic routing, rotation, uptime, and enough abstraction to keep credential stuffing, scraping, fake account creation, ad fraud, account takeover, and other abuse moving.

So the useful question is not only, “Did Google and the FBI hit the botnet?”

They did.

The harder question is whether the action removed meaningful residential-proxy capacity from the market, or whether that capacity can reappear through resellers, white-label brands, competitor pools, and successor infrastructure.

That is where forecasting earns its keep.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

TL;DR

• Google said it coordinated with the FBI, Lumen, and others to disrupt the NetNut residential proxy network, also known as Popa. Google said it disabled Google accounts and services used for malware command-and-control, shared technical intelligence on NetNut SDKs and backend C2 infrastructure, and used Google Play Protect against apps known to incorporate NetNut SDKs.
• Google estimated the NetNut network at at least 2 million devices and said it observed 316 distinct threat clusters using suspected NetNut exit nodes during one week in June 2026. Google also warned that NetNut’s reseller and white-label model means many visible proxy brands may depend on the same underlying pool.
• Alarum Technologies, NetNut’s parent company, said on July 2 that certain domains associated with NetNut had been seized by the FBI. On July 3, Alarum said additional domains had been seized, part of its services were disrupted, and prolonged disruption could have a material adverse effect on operations, financial results, and its ability to provide certain services.
• The strongest analyst framing is not “a botnet was disrupted.” The better framing is: a residential-proxy capacity provider was hit.
• The key follow-up is whether attacker capacity declined or simply changed routes.

Evidence status

Observed: Google publicly says it disrupted NetNut/Popa infrastructure with FBI, Lumen, and partner support. Alarum says NetNut-associated domains were seized and that part of its services were disrupted.

Assessed: The action is best understood as a hit against residential-proxy capacity, not only a malware takedown.

Unknown: The public record does not prove internal intent for every Popa deployment, nor does it yet show whether the market will materially reconstitute the lost capacity.

Confidence: High that the disruption raised cost. Medium-low on whether NetNut/Popa-related residential proxy capacity reconstitutes by August 31, 2026.

The thesis

A residential proxy network is not just an IP-hiding service.

It is rentable trust.

To a target platform, traffic from a residential proxy does not look like it came from a data center, bulletproof host, VPN provider, or Tor exit. It looks like it came from a normal household, small business, school, hotel, or remote-worker connection.

That creates a nasty defender problem. The IP address may be accurate, but the conclusion can still be wrong.

The IP may belong to the apparent source of abuse. It may also belong to a victim device enrolled into someone else’s proxy infrastructure. In some cases, the device owner is not the operator. They are the exit node.

That is why the NetNut/Popa story is bigger than one malware family. The real issue is the supply chain that turns consumer devices, free VPNs, Android TV boxes, torrent clients, pirated apps, and proxy SDKs into sellable residential egress.

The botnet was not only the payload.

The botnet was the supply chain.

What happened

On July 2, 2026, Google’s Threat Intelligence Group said it took coordinated action with the FBI, Lumen, and others against the NetNut residential proxy network, also known as Popa. Google said it disabled Google accounts and services used for malware command-and-control, shared technical intelligence on NetNut SDKs and backend C2 infrastructure, and used Google Play Protect to warn users and disable applications known to incorporate NetNut SDKs.

Reuters reported that Google said it weakened a network of internet-connected devices used to conceal and route malicious traffic, and that Alarum Technologies, NetNut’s parent company, had been informed of the FBI seizure of some NetNut-associated domains.

Then came the important update.

On July 3, Alarum said additional NetNut-associated domains had also been seized. The company said it was experiencing disruptions to part of its services and that, if those disruptions continued for an extended period, they were likely to have a material adverse effect on operations, financial results, and its ability to provide certain services. Alarum also said that, as of that release, neither Alarum nor NetNut had been formally contacted by the FBI or another governmental or regulatory authority about the matter.

That update matters.

It does not resolve the forecast. It does show that the disruption is not merely symbolic. Domains were seized. Services were disrupted. A public company is now telling investors there may be material business impact.

That raises cost.

The intelligence question is whether it raises cost durably.

The technical model: how residential proxy capacity is created

A residential proxy network needs supply.

That supply usually comes from devices and apps that can be enrolled into relay infrastructure. The paths vary: SDK partnerships, free VPNs with buried or missing consent, compromised IoT devices, malware in pirated content, passive-income bandwidth-sharing apps, browser extensions, and consumer software users do not understand well enough to evaluate. The FBI describes residential proxies as infrastructure that routes traffic through home and small-business networks to obscure a threat actor’s identity and location, and says devices can be pulled in with or without meaningful user awareness.

The pipeline looks like this:

Consumer device or app  -> hidden, poorly disclosed, or abused proxy SDK  -> bootstrap / load-balancer domain  -> backend relay infrastructure  -> commercial proxy gateway or reseller  -> customer traffic exits from residential IP  -> target sees ordinary-looking user traffic

Each part matters.

The device or app creates supply.

The SDK or plugin enrolls the device.

The bootstrap domain tells the enrolled device where to connect next.

The relay infrastructure brokers traffic.

The commercial gateway sells access.

The residential IP gives the customer reputation camouflage.

That last piece is the product. Attackers are not buying malware for its own sake. They are buying the ability to make abusive traffic look local, distributed, and harder to score.

For credential stuffing, that means login attempts can rotate through normal-looking ISP space.

For scraping, it means evading rate limits and geographic controls.

For account creation, it means blending automation into ordinary residential traffic.

For ad fraud, it means manufacturing traffic that looks closer to real user behavior.

For law-enforcement evasion, it means pushing attribution pressure onto the wrong machine, the wrong home, or the wrong business.

This is the uncomfortable part: the device owner may be real, the ISP may be real, and the IP attribution may be technically correct. The operator behind the activity may still be somewhere else.

Popa is better understood as a logistics layer

Popa should not be treated as just another malware label.

The better model is that Popa functions as a communications and tunneling layer that can be embedded into, delivered through, or wrapped by other ecosystems.

Synthient describes Popa as an Android proxyware SDK that turns phones, tablets, and streaming boxes into residential proxy nodes. In controlled testing on June 17, 2026, Synthient said a request sent into NetNut’s gateway exited through a device enrolled in Popa. Synthient assessed that at least some Popa-enrolled devices act as egress nodes for NetNut’s proxy network, while explicitly saying that was an analytic judgment and not a claim about NetNut’s internal knowledge or intent.

That distinction matters.

Good CTI can say “traffic egressed through this infrastructure” without pretending that proves every legal or intent question.

The public evidence strongly supports a technical relationship between Popa-enrolled devices and NetNut commercial proxy infrastructure. Google publicly treated NetNut/Popa as the target of coordinated disruption. NetNut/Alarum has disputed wrongdoing and says it investigates misuse and cooperates with law enforcement.

Those statements can all sit in the same report.

That is not hedging. That is analyst discipline.

Why the malware name is not the center of gravity

The malware name is useful for clustering. It is not the center of gravity.

The center of gravity is residential exit capacity.

Google estimated NetNut at at least 2 million devices and observed 316 distinct threat clusters using suspected NetNut exit nodes during one week in June 2026. Google also warned that NetNut’s reseller and white-label model means visible proxy brands may depend on the same underlying pool.

That matters because attackers care less about a brand than a capability.

They need:

• IPs that do not immediately look hostile
• geography that matches the target workflow
• enough rotation to avoid simple rate limits
• enough uptime to run jobs reliably
• enough abstraction that customers can buy access without caring how the supply was sourced

This is why takedown math can mislead.

A provider can lose domains and still leave market demand intact.

A botnet can shrink while competitor pools absorb customers.

An SDK can be blocked while a related SDK, wrapper, or successor package appears elsewhere.

A brand can become toxic while the capacity moves behind cleaner labels.

The defender’s question is not, “Did the named thing take damage?”

The defender’s question is, “Did the dependency get more expensive?”

The analyst trap

Most analysts will be tempted by the clean story.

Domains seized. Accounts disabled. Apps blocked. Botnet degraded. Done.

That is not wrong. It is just incomplete.

There are five traps here.

Trap 1: Treating the takedown metric as the outcome.
Domain seizures, account disables, Play Protect warnings, and backend disruption are important. But the operational outcome is whether abuse capacity declines.

Trap 2: Treating a residential IP as an actor.
A home IP can be the exit point, the victim, and the false lead at the same time.

Trap 3: Treating consent as binary.
Some residential proxy products claim consent. But buried terms, missing opt-outs, compromised apps, pirated APKs, and preloaded firmware turn “consent” into an operationally weak concept.

Trap 4: Collapsing technical linkage into legal intent.
A technical relationship is not automatically proof of knowledge, authorization, or culpability for every deployment.

Trap 5: Overweighting brand names.
Attackers buy capability. Brands are wrappers around capacity. Follow the capacity.

The better mental model is simple:

Criminal infrastructure behaves like a supply chain. Remove one supplier and the market tests substitutes. The signal is the substitution pattern.

That is the point of this case.

Do not forecast the takedown.

Forecast the adaptation.

Subscriber analysis

Public reporting tells you what was disrupted. Below the line, we do the harder analyst work: map the incentives, define what reconstitution would actually mean, and build a scoreboard for judging whether residential-proxy capacity disappeared or simply changed routes.

Forecasting move

The forecast is not trying to predict whether the takedown happened.

That part is already known.

The forecast is testing whether the market can replace the lost capability.

That means the unit of analysis is not the brand, the domain, or the malware name. It is residential egress capacity.