Authorities Dismantle Global Proxy Network SocksEscort

Authorities dismantled the global proxy network SocksEscort, a botnet that compromised routers and IoT devices across 163 countries, affecting approximately 369,000 victims. The operation generated $5.8 million in revenue from cybercriminal customers who used the service for illicit activities. The takedown involved collaboration between Eurojust, Europol, the U.S. Department of Justice (DOJ), the FBI, and Black Lotus Labs (Lumen Technologies), alongside contributions from Austria, Bulgaria, France, Germany, Hungary, Romania, and The Netherlands. No specific dates for the takedown or technical indicators (e.g., malware strains or CVE IDs) were disclosed. The network functioned as a residential proxy service, enabling threat actors to route malicious traffic through hijacked devices.