Threats · 231 days ago
International law enforcement dismantled SocksEscort, a residential-proxy botnet built from compromised routers and IoT devices. Officials say it abused about 369,000 IPs across 163 countries and was rented to criminals for fraud, DDoS, ransomware and CSAM. Authorities seized 34 domains, took down 23 servers and froze $3.5 million in cryptocurrency.
8 sources covering this story
Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries
Operation Lightning dismantled SocksEscort proxy botnet exploiting 369,000 IPs in 163 countries, disrupting fraud networks and freezing $3.5M crypto.
Law Enforcement Dismantles SocksEscort Proxy Network
Operation Lightning sees international law enforcement partners shut down ‘SocksEscort,’ a major malicious proxy service used by cybercriminals worldwide
Authorities dismantle SocksEscort proxy network behind millions in fraud - Help Net Security
A global takedown disrupted the SocksEscort proxy network that infected thousands of routers and helped cybercriminals carry out fraud.
Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet
Law enforcement agencies in the US and Europe targeted the cybercrime service that has impacted 360,000 devices since 2020.
The Record from Recorded Future
US, Europol disrupt SocksEscort network that exploited thousands of residential routers
The SocksEscort proxy network allowed cybercriminals to purchase access to routers infected with malware, which they used to conceal their location and IP addresses.
Law enforcement shuts down botnet made of tens of thousands of hacked routers | TechCrunch
An international law enforcement operation shut down a service called SocksEscort, which allegedly helped cybercriminals all over the world launch ransomware and DDoS attacks, as well as distribute child sexual abuse material.
Authorities takedown global proxy network SocksEscort
The botnet, which compromised routers and IoT devices in 163 countries, claimed about 369,000 victims and $5.8 million from its cybercriminal customers, officials said.
US disrupts SocksEscort proxy network powered by Linux malware
and Europe along with private partners have disrupted the SocksEscort cybercrime proxy network that used only edge devices compromised via the AVRecon malware for Linux.
Part of the PlainSec briefing for 2026-03-14