US, Europol disrupt SocksEscort network that exploited thousands of residential routers

Law enforcement in the U.S. and Europe dismantled the SocksEscort residential-proxy service that used AVRecon malware to compromise thousands of home and IoT routers (targeting ~1,200 device models across vendors like Cisco, D-Link, MikroTik, Netgear, TP-Link, Zyxel and others). Authorities seized 34 domains, took down 23 servers across seven countries, froze $3.5M in cryptocurrency, and noted the platform offered access to hundreds of thousands of IPs and facilitated a range of cybercrimes; private firms (Black Lotus Labs, Shadowserver) assisted the investigation.