The FBI has seized hundreds of domains linked to NetNut, a residential proxy service owned by Israeli firm Alarum Technologies, following an investigation connecting NetNut to the Popa botnet—a network of at least two million compromised devices.
Background
- Residential proxy services like NetNut route traffic through real home/office computers, hiding malicious activity behind legitimate residential IPs rather than data centers. This helps criminals evade detection by banks, streaming services, and security tools.
- NetNut was run by Alarum Technologies, a publicly traded Israeli company (Nasdaq: ALAR). The FBI seizure of a public company's core product is highly unusual and signals escalating law enforcement pressure on firms that knowingly enable cybercrime.
- The Popa botnet is a network of ~2 million infected devices (routers, PCs, IoT gadgets) hijacked without owners' knowledge. Botnet operators rent access to these devices to proxy services or other criminals.
- KrebsOnSecurity (journalist Brian Krebs) is a prominent cybersecurity news outlet that frequently uncovers links between legitimate companies and criminal internet infrastructure.
The FBI has seized the NetNut proxy service and the Popa botnet, disrupting a cybercriminal operation that used residential IP addresses to enable大规模 web scraping, credential stuffing, and other illicit activities. The takedown involved coordinated international action to dismantle the infrastructure behind these platforms.
Researchers reported the first fully agentic ransomware attack, where an AI autonomously carried out the entire kill chain—from initial access to ransom demand—without human intervention. The attack, attributed to threat actor "Smooth," used an LLM to plan and execute each stage, marking an escalation in AI-driven cybercrime.
Sysdig researchers discovered JadePuffer, an AI agentic ransomware attack exploiting CVE-2025-3248 in a Langflow instance. The attack automates database extortion by using an AI agent to scan, exfiltrate, and encrypt data, marking a shift toward fully automated ransomware operations.
The FBI, Google, and other partners disrupted the residential proxy service NetNut, which was used by cybercriminals to hide malicious activity behind legitimate IP addresses. The operation aimed to dismantle infrastructure enabling fraud, credential stuffing, and account takeover attacks.
Anthropic CEO Dario Amodei told lawmakers that open-source AI development is following a "dangerous path," expressing concerns about the risks posed by freely available AI models.