Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries

International law enforcement dismantled SocksEscort, a criminal proxy botnet that exploited 369,000 residential router IPs across 163 countries for large-scale fraud.

• •The service was powered by AVrecon malware, targeting ~1,200 device models from vendors including Cisco, D-Link, Netgear, TP-Link, and Zyxel via RCE and command injection vulnerabilities.
• •AVrecon achieves persistence by flashing custom firmware containing the malware, disabling the device's update and flashing features to cause permanent infection.
• •SocksEscort sold proxy access to criminals, offering static residential IPs with unlimited bandwidth; 5,000 proxies were priced at $200/month.
• •Operation Lightning, coordinated by Europol with 8 countries, took down 34 domains, 23 servers, and froze $3.5 million in cryptocurrency.