‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
2026-06-21T13:23:27Z•ee87c84b6fe2f25f2222edbcbabb1afc534f082592cd6ab61b59181840f227dc
account takeoveradvertising fraudaffiliatesai support botalarum technologiesandroidaws govcloudbotnetcisacredential leakdata scrapingexploit codegithub exposure','canvas breach','education sector','data extorsiotmetamicrosoftnetnutpatch tuesdaypoparansomwareresidential proxysocial engineeringthe gentlementv boxesvulnerabilities
What happened
Collection of KrebsOnSecurity reports (May–June 2026) documenting multiple high-impact cyber incidents: a four-year Android-based Popa botnet used millions of consumer TV boxes for proxying, advertising fraud and scraping — researchers link it to NetNut (operated by publicly-traded Alarum Technologies); investigative reporting on the administrator and recruitment model of the ransomware group “The Gentlemen”; Microsoft’s June Patch Tuesday with ~200 fixes (dozens critical) and public exploit code for multiple flaws; abuse of Meta’s AI support assistant to perform Instagram account takeovers; a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- ee87c84b6fe2f25f2222edbcbabb1afc534f082592cd6ab61b59181840f227dc
- Enrichment time
- 2026-06-21T13:23:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.