International Law Enforcement Disrupts SocksEscort Proxy Network

A coordinated international law enforcement operation, dubbed Operation Lightning, has successfully dismantled SocksEscort, a criminal proxy service that exploited residential routers worldwide to facilitate large-scale fraud. The U.S. Department of Justice (DoJ) reported that SocksEscort infected home and small business internet routers with malware, enabling the service to direct internet traffic through these compromised devices. Since its inception in 2009, SocksEscort claimed access to approximately 369,000 IP addresses across 163 countries, with nearly 8,000 infected routers listed as of February 2026. The operation involved authorities from Austria, Bulgaria, France, Germany, Hungary, the Netherlands, Romania, and the U.S., resulting in the seizure of 34 domains and 23 servers in seven countries.

Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 CountriesThe Register UKCyberscoop

SocksEscort utilized malware known as AVRecon, which targeted vulnerabilities in residential modems from various manufacturers, including Cisco, D-Link, and Netgear. This malware allowed cybercriminals to remotely control infected devices and route internet traffic through them, effectively masking their true locations. The service reportedly generated over EUR 5 million from customers who paid anonymously using cryptocurrency. The FBI noted that the botnet was responsible for significant financial losses due to various cybercrimes, including ransomware, identity theft, and business email compromises.

The Register UKCyberscoopAuthorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries

The fraudulent activities facilitated by SocksEscort have resulted in substantial losses for individuals and businesses. Notable victims include a New York cryptocurrency exchange customer defrauded of $1 million, a Pennsylvania manufacturing business that lost $700,000, and U.S. service members who were defrauded of $100,000. The average size of the botnet was approximately 20,000 distinct victims weekly, peaking at over 15,000 daily in January 2025.

The Register UK

Catherine De Bolle, executive director at Europol, emphasized the anonymity that proxy services like SocksEscort provide to criminals, stating, “Cybercrime thrives on anonymity.” FBI Deputy Assistant Director Jason Bilnoski highlighted the operation's significance, noting that the seized servers would lead to further investigations into other criminal activities. He remarked, “The proliferation of these illicit residential proxies represents a formidable challenge for our government and private-sector partners.”

The Register UK

While the operation has been largely praised, some experts caution that dismantling such networks is only a temporary solution. Chris Formosa, a senior lead information security engineer at Black Lotus Labs, noted the potential for SocksEscort's operators to re-emerge, stating, “Given the high volume of victim generation, it would not surprise me if they eventually hit something really important.”

Cyberscoop

There are discrepancies regarding the total number of unique IP addresses victimized by SocksEscort. While some sources report 280,000 distinct IPs affected since early 2025, others indicate that the botnet has maintained an average of 20,000 victims weekly since early 2024. Additionally, the exact financial losses attributed to SocksEscort's operations vary among reports.

Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries

Following the disruption of SocksEscort, law enforcement agencies are expected to continue investigating the broader network of cybercriminals who utilized the service. The FBI has initiated Operation Winter Shield, which includes defensive measures to enhance security against similar threats in the future.

Cyberscoop