Google Dismantles Massive Chinese Cyber Network Linked to Malware
Google's operation reduced IPIDEA's proxy device pool by millions, disrupting over 550 threat groups using the network for espionage and cybercrime.
- On Jan 28, Google Threat Intelligence Group seized domains and used Google Play Protect, with Google saying, `'We believe our actions have caused significant degradation of IPIDEA's proxy network and business operations, reducing the available pool of devices for the proxy operators by millions.'`
- IPIDEA operated at least 13 residential proxy brands and enrolled devices via proxy SDKs embedded in apps, sometimes paid for by app developers, while GTIG observed over 550 threat groups using IPIDEA exit nodes in a seven‑day period in January 2026.
- Google found over 600 Android applications and 3,075 unique Windows files linked to the network, working with Spur, Lumen's Black Lotus Labs, and Cloudflare to map and disrupt IPIDEA's domain resolution.
- Google said the removals protect millions of consumer devices, aiming to stop exploitation by cybercriminals and disrupting a global marketplace selling access to hijacked consumer devices.
- GTIG says the move should cripple affiliated operators and resellers, as more than 550 threat groups used IPIDEA and its botnets threaten cybercriminal anonymity.
45 Articles
45 Articles
Google's disruption rips millions out of devices out of malicious network
Millions of devices used as proxies by cybercriminals, espionage groups and data thieves have been removed from circulation following Google’s disruption of IPIDEA, a China-based residential proxy network. The reduction in available proxy devices came after Google’s Threat Intelligence Group used legal action and intelligence sharing to target the company’s domain infrastructure, Google said in a blog post Wednesday. Google’s action, aided by C…
Coverage Details
Bias Distribution
- 78% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium













