Disrupting the World's Largest Residential Proxy Network

Google Threat Intelligence Group disrupted IPIDEA, one of the world's largest residential proxy networks used by threat actors for espionage, cybercrime, and information operations. The operation involved taking down command-and-control domains, sharing intelligence with partners, and protecting Android devices through Google Play Protect. IPIDEA controlled multiple proxy brands and SDKs that secretly enrolled millions of consumer devices as exit nodes. The disruption reduced available devices by millions and impacted over 550 tracked threat groups from China, DPRK, Iran, and Russia who used the network to mask malicious activities including password sprays and infrastructure access.