Authorities takedown global proxy network SocksEscort

SocksEscort, a long-running residential proxy botnet built by compromising routers and IoT devices (via an exploited modem vulnerability and AVRecon malware), was dismantled in a multinational operation called Operation Lightning; the service claimed access to hundreds of thousands of IPs across 163 countries, generated roughly $5.8M in customer payments, and peaked at more than 15,000 daily victims in January 2025. Authorities seized domains and servers, froze about $3.5M in cryptocurrency, and credited assistance from Europol, Black Lotus Labs, Shadowserver and several national agencies.