20-Year-Old Proxy Botnet Taken Down After Weekly Exploitation of 1,000 Unpatched Devices

Lumen’s Black Lotus Labs, in coordination with U.S. and Dutch law enforcement, disrupted a sophisticated proxy botnet active since at least 2004 that hijacked thousands of unpatched IoT and EoL devices to sell residential IP proxies to criminals; researchers observed ~1,000 weekly active bots, primary C2 servers in Turkey, HTTP (port 80) and UDP (port 1443) communications, and easy-access monetization via cryptocurrency, highlighting persistent risks from unpatched consumer devices despite the takedown.