SocksEscort Proxy Network Disrupted in Major International Law Enforcement Operation

On March 11, 2026, international law enforcement agencies executed Operation Lightning, dismantling the SocksEscort proxy network, which had compromised over 369,000 routers and IoT devices across 163 countries. The network was used by cybercriminals to facilitate large-scale fraud, including ransomware attacks, identity theft, and the distribution of child sexual abuse material (CSAM). Authorities seized 34 domains and 23 servers, and froze $3.5 million in cryptocurrency linked to the operation. The botnet was powered by AVRecon malware, which exploited vulnerabilities in residential modems. Since its inception in 2009, SocksEscort had generated approximately €5 million from its illicit services. The takedown is expected to have a significant impact on ongoing cybercrime activities. Law enforcement agencies involved included the FBI, Europol, and various national police forces from Europe. The operation highlights the growing threat posed by residential proxy networks to cybersecurity.

Key Points: • SocksEscort compromised over 369,000 devices globally, facilitating extensive cybercrime. • Operation Lightning resulted in the seizure of 34 domains and 23 servers across seven countries. • The operation was powered by the AVRecon malware, which targeted residential routers.