Executive summary

European and US authorities disrupted SocksEscort, a paid proxy service that, according to US court documents, sold criminals access to malware-infected home and small-business routers, in a coordinated action on 11 March 2026. Eurojust, whose release does not name the service, says 24 servers in seven countries were taken down and 34 domains seized, while Europol, as quoted by BleepingComputer, gives 23 servers; Eurojust also says US authorities froze approximately EUR 3.5 million in cryptocurrency. Lumen's Black Lotus Labs, which assisted the US Justice Department, says SocksEscort was powered by AVrecon, router malware it first made public in 2023, and that over half of the service's victims were in the United States or the United Kingdom. Neither the Eurojust nor the IRS Criminal Investigation release says the malware was removed, and the FBI says that in some cases the actors disable a device's update features, leaving it "essentially permanently infected", so we assess it is likely (B2) that many of the routers stay infected or open to reinfection until their owners replace or secure them.

The operation as announced

Eurojust's release of 12 March does not name the service, but TechCrunch reports Europol's SocksEscort announcement giving matching figures (more than 369,000 devices in 163 countries) and the same disconnection of infected routers. Eurojust says authorities from France, Austria, the Netherlands and the United States began working together, with coordination by Eurojust and Europol, after identifying numerous victims of the malware used for the proxy service. In a coordinated operation on 11 March, by Eurojust's account, authorities took down 24 servers in seven countries and seized 34 domains, and US authorities froze approximately EUR 3.5 million in cryptocurrency. Europol's figure, as BleepingComputer quotes it, is "34 domains as well as 23 servers located in seven countries", and BleepingComputer gives the frozen sum as $3.5 million. CyberScoop and The Register report the action as Operation Lightning, and The Record reports that the investigation began in June 2025.

Eurojust lists participating authorities from eight countries: Austria, Bulgaria, France, Germany, Hungary, the Netherlands, Romania and the United States.

On the US side, IRS Criminal Investigation's (IRS-CI) copy of the Justice Department announcement, dated 12 March, says a court-authorised international operation led by the US Justice Department disrupted SocksEscort the previous day, and that the US government executed seizure warrants against a few dozen US-registered internet domains allegedly engaged in the criminal activity. It names IRS-CI, the FBI and the Defense Criminal Investigative Service as the investigating agencies, says prosecutors in the Eastern District of California are handling the case, and carries the Justice Department's thanks to Lumen's Black Lotus Labs and the Shadowserver Foundation. Neither the Eurojust nor the IRS-CI release names a defendant or announces an arrest.

How the service worked

Eurojust describes a paid service that let customers hide their real IP addresses by giving them access to existing addresses around the world, made available by infecting modems belonging to individuals or organisations with malware. After infection, Eurojust says, the owners would not be aware that their addresses were being used for illegitimate activities. Customers paid through a platform that allowed anonymous payment in cryptocurrency, which the service's administrators are also suspected of hosting; Eurojust estimates that it received more than EUR 5 million from them.

The IRS-CI release says SocksEscort's malware let it direct internet traffic through infected routers, and that cybercriminals bought that access to conceal their true IP addresses and locations, furthering frauds such as takeovers of US bank and cryptocurrency accounts and fraudulent unemployment insurance claims. According to BleepingComputer, the service advertised "clean" IP addresses from major internet service providers, such as Comcast and Verizon, that could pass multiple blocklists. TechCrunch reports that Europol said SocksEscort was used to facilitate ransomware, distributed denial-of-service (DDoS) attacks and the distribution of child sexual abuse material.

The FBI's flash alert of 12 March says SocksEscort uses AVrecon to target approximately 1,200 device models made by Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link and Zyxel, and that the vast majority of observed infected devices are small-office/home-office (SOHO) routers infected through critical vulnerabilities such as remote code execution and command injection. CyberScoop reports that, according to officials, the operators built the botnet by exploiting a vulnerability in residential modems from an unnamed vendor.

Scale and victims, as officials and researchers state them

The headline figures count different things.

Figure What it counts Who states it
About 369,000 Different IP addresses SocksEscort offered to sell access to since the summer of 2020 IRS-CI release
Approximately 369,000 Devices SocksEscort is believed to have compromised and sold access to since 2020 FBI alert
369,000, across 163 countries Routers and other devices the service compromised Eurojust
About 8,000, of which 2,500 in the US Infected routers the SocksEscort application listed as of February 2026 IRS-CI release
280,000 Distinct IP addresses victimised since early 2025 Black Lotus Labs
About 20,000 a week Average distinct victims over the past several years, through an average of 15 command-and-control (C2) nodes Black Lotus Labs
About 124,000 Users (customers) of the service Eurojust; an FBI deputy assistant director, to The Register

Black Lotus Labs' post of 12 March also says over half of SocksEscort's victims were in the United States or the United Kingdom, a finding TechCrunch quoted the same day. The IRS-CI release gives three examples of US victims: a cryptocurrency exchange customer in New York defrauded of $1 million, a manufacturing business in Pennsylvania defrauded of $700,000, and current and former US service members with MILITARY STAR cards defrauded of $100,000. An FBI deputy assistant director told The Register that SocksEscort is responsible for "tens of millions of dollars in losses".

We assess it is likely (B2) that the pool of routers SocksEscort could sell at any one time numbered in the thousands to low tens of thousands, and that 369,000 is a cumulative count built up over more than five years rather than the size of the botnet on 11 March. The US release counts different IP addresses offered since the summer of 2020 and puts the February 2026 listing at about 8,000 routers, and Black Lotus Labs' weekly average is about 20,000 distinct victims. The Eurojust and FBI descriptions of 369,000 compromised devices should be read with that in mind.

AVrecon and the 2023 precedent

Lumen announced AVrecon on 12 July 2023. Its press release says a 28-day snapshot showed the malware had infiltrated more than 70,000 machines and gained a persistent hold in more than 40,000 of them in 20 countries, and quotes Black Lotus Labs' director of threat intelligence saying it went undetected for two years. Lumen said threat actors use AVrecon primarily to steal bandwidth, without affecting end users, to create a residential proxy service that launders activity including password spraying and digital advertising fraud.

The link to SocksEscort followed within two weeks. KrebsOnSecurity reported on 25 July 2023 that Spur, a company that tracks proxy services, said the addresses Lumen had tagged as AVrecon's C2 servers all tie back to SocksEscort. The same report quotes a Lumen researcher saying that on 13 July, the day after Lumen published its research and started blocking traffic to the malware's control servers, the people maintaining the botnet moved infected systems to new C2 infrastructure.

According to BleepingComputer, Lumen's 2023 null-routing of the C2 infrastructure had a limited effect, and over time the operators returned to regular operations, routing communications through 15 C2 nodes. Black Lotus Labs' 12 March post describes the botnet as "marketed exclusively to criminals and composed solely of compromised edge devices".

The FBI's alert says AVrecon's persistence varies by device. In some cases the actors flash custom firmware that runs AVrecon at start-up and silently disables the device's update and flashing features, leaving such devices "essentially permanently infected". In others a power cycle clears the infection, although in at least one case AVrecon's C2 servers re-infected a device through the same vulnerabilities.

What router owners and network defenders should do

For router owners, the FBI's 12 March alert recommends:

  • Replace end-of-life devices. It says devices classified as end-of-life by their manufacturers generally do not receive security patches, and advises considering replacing an unsupported device with a model still receiving security updates.
  • Patch by hand, on a schedule. Many SOHO routers may not apply patches automatically, and updating often requires manual action in the administration panel or re-flashing the firmware. The FBI adds that a patch may not remediate a device already infected.
  • Close remote access. Change all default passwords, and disable remote administration or restrict exposed ports and services with access control lists or firewall rules.
  • Do not rely on a reboot. Periodic reboots can disrupt some infections, the FBI says, but addressing known vulnerabilities is critical to prevent reinfection, and some AVrecon variants silently disable factory resets and re-flashing.

For network defenders and service providers:

  • Do not treat a residential address as proof of a legitimate user. Lumen's July 2023 release warned that malicious activity can appear to come from a residential IP address in a country other than the actual origin, bypassing geofencing and blocking by autonomous system number (ASN). It advised defenders to keep looking for attacks on weak credentials and suspicious login attempts even from residential addresses.
  • Monitor and isolate edge devices. The FBI advises monitoring, isolating or restricting access to SOHO routers and other devices that cannot run anti-virus or endpoint detection and response software.
  • Take indicators from the source. The alert lists AVrecon loader and malware hashes, C2 request paths and headers, and C2 addresses and domains observed as of March 2026, and cautions that these are historically observed infrastructure to corroborate with current telemetry. We do not reproduce them here.
  • Check the customer estate. Internet service providers that supply customer routers should check their deployed models against the alert's list of the 20 most represented device models. This is our recommendation.

Earlier actions against proxy services

The FBI's May 2024 announcement on the dismantled 911 S5 service called it one of the largest residential proxy services and botnets, with over 19 million compromised IP addresses in over 190 countries; unlike SocksEscort, 911 S5 spread through proxy backdoors built into free virtual private network applications. The Record lists QakBot, 911 S5, IPStorm, KV, DanaBot, Anyproxy and 5socks among botnets that have faced law enforcement scrutiny since 2021, and BleepingComputer reports that Black Lotus Labs revealed another proxy botnet, KadNap, which targets ASUS routers, earlier the same week.

Outlook

This section is assessment. The 2023 episode shows how quickly these operators can recover from network blocking: a Lumen researcher told KrebsOnSecurity they moved infected routers to new C2 infrastructure the day after Lumen began blocking, and BleepingComputer reports that they later returned to regular operations. This action goes further, taking down servers in seven countries, seizing domains and freezing funds, and an FBI deputy assistant director told The Register that the seized servers "will most definitely lead us to additional evidence". Even so, with no arrest announced in the Eurojust or IRS-CI release, and with the FBI describing some devices as essentially permanently infected and one re-infected by AVrecon's C2 servers, we assess it is a realistic possibility (B3) that the same routers, or the weaknesses that let AVrecon in, are put back to criminal use by the operators or a successor service in the coming months. UK defenders have particular reason to act, given the share of victims Black Lotus Labs places in the United States and the United Kingdom.

Further reading