FBI Seizes NetNut Proxy Platform, Popa Botnet
2026-07-04T07:23:24Z•2bf559e3f609955cd7365dc8ede79d1a162ce82f84f03b2498593b500af70e1a
AWS GovCloudAlarum TechnologiesCISADDoSFBI seizureGitHub leakInstagram compromiseIoT botnetKimwolfMeta AI abuseNetNutNetherlands seizurePopaRussian influence operationsScattered SpiderStark Industries SolutionsThe Gentlemen ransomware group (ransomware)account takeoverbotmaster arrestbotnetcredential exposuredata leaklaw enforcement takedownresidential proxysupply-chain
What happened
KrebsOnSecurity reporting (May–Jul 2026) describes multiple high-impact cyber incidents: the FBI seized hundreds of domains tied to NetNut after research linked the Alarum Technologies-operated residential proxy service to the Popa Android-based botnet (millions of compromised devices); separate reporting ties Kimwolf (IoT DDoS botnet) and the Popa botnet to identified operators and arrests. Law enforcement in the Netherlands seized ~800 servers and arrested hosting co-owners for aiding Russian cyber operations. Two alleged Scattered Spider members pleaded guilty in the U.K. for the 2024 TfL (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 2bf559e3f609955cd7365dc8ede79d1a162ce82f84f03b2498593b500af70e1a
- Enrichment time
- 2026-07-04T07:23:24Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.