FBI Warns of AVrecon Malware Targeting Network Devices Across 163 Countries

**Executive summary:** The FBI found AVrecon malware being used by the SocksEscort criminal service to infect vulnerable SOHO routers (targeting ~1,200 device models) and convert roughly 369,000 devices into a global residential proxy network used for fraud, password attacks, and other criminal activity; persistence via firmware flashing and modular C2 functionality make this a widespread and resilient threat, and defenders are advised to apply firmware updates, replace EoL devices, disable remote admin, and monitor known IOCs.