Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries

Why It Matters

The takedown highlights the growing threat of IoT‑based proxy services that mask malicious traffic, underscoring the need for stronger router security and cross‑border cooperation.

Key Takeaways

• 369k IPs in 163 countries compromised
• Operation Lightning seized 34 domains, 23 servers
• $3.5M cryptocurrency frozen
• AVrecon targets 1,200 router models
• Victims lost over $1.8M to fraud

Pulse Analysis

The proliferation of residential‑router botnets has created a lucrative underground market for proxy services that hide criminal activity behind legitimate‑looking IP addresses. By compromising home and small‑office routers, actors can offer "static residential IPs" with unlimited bandwidth, a product that appeals to fraudsters, ransomware operators, and even distributors of illicit content. The SocksEscort operation exemplifies how low‑cost, high‑volume compromises can be monetized at scale, leveraging vulnerabilities in popular brands such as Cisco, Netgear, and TP‑Link.

Operation Lightning demonstrated the power of coordinated international action. Law‑enforcement teams from the United States, Austria, France, Germany, and several other nations jointly seized 34 domains and 23 servers, disrupting the command‑and‑control infrastructure that powered the botnet. In addition to crippling the service, authorities froze $3.5 million in cryptocurrency linked to the proxy sales, sending a clear financial deterrent to similar enterprises. The operation also exposed the extensive reach of AVrecon malware, which has infected over 280,000 distinct IPs since early 2025.

For the broader cybersecurity ecosystem, the takedown serves as a warning and a call to action. Manufacturers must accelerate firmware patching and secure update mechanisms to prevent persistent infections, while ISPs and enterprises should monitor for anomalous outbound traffic that may indicate proxy abuse. The incident also reinforces the importance of public‑private partnerships and legal frameworks that enable rapid, cross‑border responses to threats that transcend national boundaries. As IoT devices continue to proliferate, proactive defenses will be essential to curb the next generation of proxy‑based botnets.