Law Enforcement Dismantles SocksEscort Proxy Network in Operation Lightning

International law enforcement executed Operation Lightning to dismantle the SocksEscort malicious proxy service, which since 2020 allegedly compromised over 360,000 routers and IoT devices across 163 countries and offered tens of thousands of proxies to customers. The infected devices were used to anonymize criminal activity—enabling bank and cryptocurrency account takeovers, fraudulent unemployment claims, DDoS attacks, ransomware distribution, and CSAM dissemination—and authorities seized domains and servers across multiple countries and froze cryptocurrency assets.