‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
2026-06-19T19:23:31Z•208c2628d56d603f3f7e67b7ed7914a4b4ba215abb202fe1158dbbd611309d3c
AI support botAWS GovCloudAlarum TechnologiesAndroidCISAGitHub leakInstagram compromiseMetaMicrosoftNetNutPatch TuesdayPopaRussia-linked operations','Kimwolf','IoT botnet','DDoS','CanvasTV boxesThe Gentlemenaccount takeoveradvertising fraudbotnetcredential leakdata scrapinghosting seizurepublic exploitransomwareresidential proxysmart TV
What happened
Multiple high-impact cyber incidents and intelligence notes: researchers link the Android-based Popa botnet — which enslaved millions of consumer TV boxes to provide residential proxy services used for ad fraud, account takeovers and mass scraping — to NetNut/Alarum Technologies (NASDAQ: ALAR). A fast-growing ransomware affiliate operation called “The Gentlemen” is profiled, with clues to the administrator’s real-world identity. Microsoft’s June 2026 Patch Tuesday fixed nearly 200 vulnerabilities (dozens rated critical) with public exploit code reported for at least three flaws. Attackers also
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 208c2628d56d603f3f7e67b7ed7914a4b4ba215abb202fe1158dbbd611309d3c
- Enrichment time
- 2026-06-19T19:23:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.