Google Dismantles Massive Chinese Cyber Network Linked to Malware
Google's operation reduced IPIDEA's proxy device pool by millions, disrupting over 550 threat groups using the network for espionage and cybercrime.
- On Jan 28, Google Threat Intelligence Group seized domains and used Google Play Protect, with Google saying, 'We believe our actions have caused significant degradation of IPIDEA's proxy network and business operations, reducing the available pool of devices for the proxy operators by millions.'
- IPIDEA operated at least 13 residential proxy brands and enrolled devices via proxy SDKs embedded in apps, sometimes paid for by app developers, while GTIG observed over 550 threat groups using IPIDEA exit nodes in a seven‑day period in January 2026.
- Google found over 600 Android applications and 3,075 unique Windows files linked to the network, working with Spur, Lumen's Black Lotus Labs, and Cloudflare to map and disrupt IPIDEA's domain resolution.
- Google said the removals protect millions of consumer devices, aiming to stop exploitation by cybercriminals and disrupting a global marketplace selling access to hijacked consumer devices.
- GTIG says the move should cripple affiliated operators and resellers, as more than 550 threat groups used IPIDEA and its botnets threaten cybercriminal anonymity.
45 Articles
45 Articles
Google Dismantles IPidea’s Global Proxy Network in Unprecedented Cybercrime Crackdown
In one of the most significant operations against cybercriminal infrastructure in recent years, Google has successfully disrupted what it describes as one of the world’s largest residential proxy networks, operated by Chinese company IPidea. The tech giant’s coordinated action removed millions of compromised devices from the network, marking a watershed moment in the ongoing battle against proxy-based cybercrime that has enabled everything from …
Google's disruption rips millions out of devices out of malicious network
Millions of devices used as proxies by cybercriminals, espionage groups and data thieves have been removed from circulation following Google’s disruption of IPIDEA, a China-based residential proxy network. The reduction in available proxy devices came after Google’s Threat Intelligence Group used legal action and intelligence sharing to target the company’s domain infrastructure, Google said in a blog post Wednesday. Google’s action, aided by C…
Google disrupts IPIDEA residential proxy networks fueled by malware
IPIDEA, one of the largest residential proxy networks used by threat actors, was disrupted earlier this week by Google Threat Intelligence Group (GTIG) in collaboration with industry partners. [...]
Coverage Details
Bias Distribution
- 82% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
