Google Battles Firm Linked to Cyber Weapon

 

“Google has aimed a knockout blow at a massive cyber weapon that researchers say is running silently on millions of devices in the homes of consumers.

 

On Wednesday, Google used a federal court order to get dozens of domains belonging to Ipidea removed from the internet, said Google, a unit of Alphabet. Google and security researchers say the mysterious Chinese company is an unsavory enterprise that sneaks unwanted and dangerous software on millions of phones, home computers and Android devices.

 

Control of the domains allowed Google to both shut the public websites and technical back-end of the company, which operates using more than a dozen brand names. Google has also taken steps to remove hundreds of apps affiliated with the company from Android devices, it said.

 

The actions are expected to knock more than nine million Android devices off Ipidea's network. They target a little known but important part of the internet that has increasingly worried cybersecurity experts.

 

Called "residential proxy" networks, these online services are built out of apps that are installed on virtually any type of internet-connected device -- among them media players, PCs and mobile phones. Companies such as Ipidea then rent out access to the devices to paying customers who want to use the internet anonymously.

 

The businesses operate like Airbnbs for network bandwidth, except the people whose devices are being rented out often don't realize what is happening.

 

Last year, Google sued the anonymous operators of a network of more than 10 million internet-connected televisions, tablets and projectors, saying they had secretly pre-installed residential proxy software on them. Wednesday's action was a continuation of an order Google received in that case because of links between that network and Ipidea, Google said.

 

Contacted this week, before the takedown, an Ipidea spokeswoman acknowledged in an email that the company and its partners had engaged in "relatively aggressive market expansion strategies" and "conducted promotional activities in inappropriate venues (e.g., hacker forums)," but she said it had since improved its business practices.

 

There are legitimate uses for Ipidea's service, which can be used to surf the internet anonymously or to scrape websites for data.

 

But from the time the company first gained prominence, in late 2022, it marketed its services in criminal marketplaces, said Riley Kilmer, the co-founder of Spur Intelligence, which tracks residential proxy activity.

 

Residential proxies have also become a go-to service for criminals and state-sponsored hackers who want to cover their tracks, said John Hultquist, chief analyst with Google's Threat Intelligence Group.

 

"It's a consumer issue and it's a national-security issue at the same time," he said. "It's enabling some of the most serious threats to our country."

 

The Ipidea spokeswoman said the company was founded in 2020 and employs several hundred employees with headquarters in China.

 

Its proxy network covers 220 countries worldwide and includes "tens of millions" of devices, she said.” [1]

 

1. Google Battles Firm Linked to Cyber Weapon. McMillan, Robert.  Wall Street Journal, Eastern edition; New York, N.Y.. 29 Jan 2026: B1.