THREAT OPS › Threat News › ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
<p>For the past four years, a sprawling Android-based botnet called <strong>Popa</strong> has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded that the Popa botnet is linked to <strong>NetNut</strong>, a “residential proxy” provider
MITRE ATT&CK techniques
Indicators of compromise
- https://synthient.com/blog/who-are-the-victims-of-residential-proxiesurl
- https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet/url
- https://www.qurium.org/forensics/finding-popa/url
- https://www.f6s.com/company/ninjatech.iourl
- https://synthient.com/blog/popa-from-sourcing-to-distributionurl
- https://spur.us/blog/how-proxy-providers-co-opt-entire-networksurl
- https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/url
- https://copyrightalliance.org/ai-copyright-lawsuit-developments-2025/url
- https://www.cni.org/topics/ci/artificial-intelligence-bots-and-repositories-results-and-next-steps-from-coar-surveyurl
- https://blog.doaj.org/2026/01/26/open-access-vs-open-excess-doaj-and-ai-scraper-bots/url
- https://www.infoblox.com/blog/threat-intelligence/residential-proxies-in-the-wild/url
- gmslb.netdomain
- safernetwork.iodomain
- tera-home.comdomain