Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries

A coordinated international law-enforcement action (Operation Lightning) dismantled SocksEscort, a criminal proxy service that used AVrecon malware to enslave hundreds of thousands of residential and SOHO routers across 163 countries to resell proxy access for fraud and other crimes. SocksEscort is reported to have offered access to hundreds of thousands of IPs, victimized hundreds of thousands of addresses since 2025, and enabled large-scale fraud (multiple victims defrauded of hundreds of thousands to millions), while leveraging firmware flashing for persistence and exploiting RCE/command-injection vulnerabilities; the takedown removed domains and servers and froze cryptocurrency and payments linked to the service.