Feds Takes Down SocksEscort Proxy Network Used in Global Fraud Schemes

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SocksEscort Proxy Network Disrupted in Major International Law Enforcement Operation On March 11, 2026, international law enforcement agencies executed Operation Lightning, dismantling the SocksEscort proxy network, which had compromised over 369,000 routers and IoT devices across 163 countries. The network was used by cybercriminals to facilitate large-scale fraud, including ransomware attacks, identity theft, and the distribution of child sexual abuse material (CSAM). Authorities seized 34 domains and 23 servers, and froze $3.5 million in cryptocurrency linked to the operation. The botnet was powered by AVRecon malware, which exploited vulnerabilities in residential modems. Since its inception in 2009, SocksEscort had generated approximately €5 million from its illicit services. The takedown is expected to have a significant impact on ongoing cybercrime activities. Law enforcement agencies involved included the FBI, Europol, and various national police forces from Europe. The operation highlights the growing threat posed by residential proxy networks to cybersecurity. 31 sources 73