Authorities Dismantle Malicious Proxy Service Used to Deploy Malware Attacking Thousands of Users

An international operation led by the U.S. Justice Department has dismantled SocksEscort, a large-scale residential proxy network. This service compromised numerous home and small business routers globally, facilitating anonymous cybercriminal activity.

The takedown involved seizing several U.S.-registered internet domains and dismantling server infrastructure in multiple countries.

Court documents reveal that SocksEscort's infrastructure deployed malware onto vulnerable internet routers. These infected devices became nodes within a proxy network, with access sold to criminals. By routing traffic through these compromised networks, attackers concealed their IP addresses and locations.

The use of residential IP addresses, which typically have high trust reputations, allowed attackers to bypass geographic blocking and security filters.

Since summer 2020, SocksEscort provided access to approximately 369,000 unique IP addresses. In February 2026, around 8,000 infected routers were available for sale on the platform. Approximately 2,500 compromised devices were located in the United States.

SocksEscort facilitated significant cybercrimes, including bank account takeovers and large-scale cryptocurrency theft, resulting in financial losses for American citizens and businesses.

A New York resident lost $1 million in a cryptocurrency exchange account takeover. A Pennsylvania business was defrauded of $700,000. U.S. military personnel experienced $100,000 in losses due to compromised credit cards.

The dismantling of the botnet required extensive international cooperation. The U.S. government seized related domains, while law enforcement in Austria, France, and the Netherlands took down supporting physical servers.

The FBI Sacramento Field Office, IRS Criminal Investigation unit, and Department of Defense led the investigation, with support from Europol, Eurojust, and authorities in Germany, Bulgaria, Hungary, and Romania. Private sector researchers from Lumen’s Black Lotus Labs and the Shadowserver Foundation provided critical threat intelligence.

Mitigation steps suggested for preventing recruitment into proxy botnets include:

Regularly updating router firmware to address vulnerabilities. Changing default administrative passwords to strong, unique credentials. Disabling remote management interfaces on consumer routers. Monitoring network traffic for unusual activity.

Based on reporting by Cyber Security News.