FBI Seizes NetNut Proxy Platform, Popa Botnet
2026-07-07T19:23:32Z•f4ec06f960e92c1165ad866d765f241ca9ef829b721248e30b69f0093d4fdaa8
AWS-GovCloudAlarum TechnologiesAndroid-malwareCISAFBIKimwolf','DDoS','Netherlands','hosting-seizure','Stark-IndustrieMeta-AI-exploitMicrosoft-Patch-TuesdayNetNutPopaPopa-botnetScattered SpiderThe Gentlemenaccount-compromiseaccount-takeoveradvertising-fraudbotnetcredentials-leakdata-scrapingdomain-seizureexploit-codepublic-data-leakransomwareresidential-proxyzero-day-exploits
What happened
Multiple high-impact cyber incidents reported: the FBI, working with industry, seized hundreds of domains tied to NetNut — a residential-proxy service operated by publicly traded Alarum Technologies — after researchers linked NetNut to the Popa botnet, an Android/IoT-based network leveraging millions of compromised consumer devices for advertising fraud, account takeovers and mass data-scraping. Separately, law enforcement actions and legal developments include guilty pleas by Scattered Spider members, arrests in the Kimwolf botnet case, and Dutch seizures/arrests of hosting infrastructure ab/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- f4ec06f960e92c1165ad866d765f241ca9ef829b721248e30b69f0093d4fdaa8
- Enrichment time
- 2026-07-07T19:23:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.