NetNut proxy network disrupted, 2 million infected devices cut off

Multiple high-impact incidents and active threats were reported: law enforcement and Google disrupted the NetNut residential-proxy network controlling ~2 million compromised Android devices; CISA and others warned that a Microsoft SharePoint RCE patched in May and a Cisco Unified CM flaw patched in June are being actively exploited; the FortiBleed credential-theft campaign has been tied to INC/Lynx ransomware operators; and a ShinyHunters data exposure affected Medtronic. New attacker tooling and tactics are also emerging: the ARToken PhaaS (affiliate of EvilTokens) exposes a Microsoft 365 ph‑