Authorities Disrupt SocksEscort Proxy Service Linked to AVrecon Botnet
Basically, police shut down a service that let criminals hide online by using hacked devices.
Authorities have disrupted the SocksEscort proxy service tied to the AVrecon botnet. This operation affected around 360,000 devices globally. Criminals used these compromised devices for various illegal activities, leading to significant financial losses for victims.
How It Works
The SocksEscort proxy service operated by leveraging the AVrecon botnet?, which infected around 360,000 devices since its inception in 2020. This malicious service allowed cybercriminals to route their internet traffic through compromised devices, effectively hiding their identities while engaging in illegal activities. The operation was a significant threat, as it provided anonymity for various cybercrimes, including ransomware attacks and DDoS attacks.
On March 11, 2026, a coordinated effort by law enforcement agencies from the US and Europe, dubbed Operation Lightning, successfully disrupted the SocksEscort? service. Authorities seized 34 domains and 23 servers across seven countries, freezing approximately $3.5 million in cryptocurrency?. This operation showcased the power of international collaboration in combating cybercrime.
Who's Being Targeted
The victims of this proxy service were primarily home and small business internet routers. Many of these devices were hijacked due to vulnerabilities? in their firmware?, allowing the SocksEscort? service to exploit them without the owners' knowledge. The DoJ reported that these compromised devices were used to facilitate various fraud?ulent activities, including bank and cryptocurrency? account takeovers.
The impact was widespread, with more than 369,000 routers infected across 163 countries. This global reach meant that criminals could conduct operations targeting individuals and businesses alike, significantly increasing the risk of financial loss for many. Victims included a crypto investor who lost $1 million and a manufacturing firm that lost $700,000.
Signs of Infection
Detecting whether your device has been compromised can be challenging. Signs may include unexpected slowdowns in internet speed, unusual traffic patterns, or unfamiliar devices connected to your network. Users often remain unaware that their devices are being exploited for illicit activities, making it crucial to stay vigilant.
To mitigate risks, it's essential to regularly check for firmware? updates and apply them promptly. This practice can help close vulnerabilities? that cybercriminals exploit. Additionally, employing strong passwords and network security measures can further protect against unauthorized access.
How to Protect Yourself
To safeguard your devices and personal information, take proactive steps. Start by ensuring your router and other internet-connected devices are updated with the latest firmware?. This can significantly reduce the chances of being targeted by malware? like AVrecon?.
Consider using a reputable security solution that can monitor your network for unusual activity. Regularly changing your passwords and using unique ones for different accounts can also enhance your security. Finally, educate yourself about the latest cyber threats and stay informed about best practices to keep your digital life secure. By taking these measures, you can help protect yourself from falling victim to similar cybercrime schemes in the future.
Security Affairs