Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon
Summary
US and European authorities disrupted SocksEscort, a proxy service powered by AVrecon on compromised routers and IoT devices. Authorities seized 34 domains and 23 servers; the US froze $3.5 million in cryptocurrency. The FBI also issued an AVrecon alert.
Key points
- Europol and the US Justice Department said roughly 363,000 IP addresses in 163 countries had been linked to SocksEscort since 2020.
- In February 2026, the service was supported by about 8,000 hacked routers, including 2,500 in the US.
- Europol said authorities seized 34 domains and 23 servers in seven countries; the US froze $3.5 million in cryptocurrency, and infected modems were disconnected.
- The FBI said SocksEscort operators exploited known router and IoT vulnerabilities, including remote code execution and command injection, to deploy AVrecon.
- The FBI issued an AVrecon alert with information on malware distribution, execution, persistence and communications, along with indicators of compromise and device-security recommendations.
- Lumen Technologies said SocksEscort averaged about 20,000 distinct victims weekly and routed communications through an average of 15 command-and-control nodes.
Article Details
- Event Type
- Law enforcement disruption and seizure of the SocksEscort malicious proxy service, which was powered by the AVrecon botnet.
- Impact
- Europol reported that authorities seized 34 domains and 23 servers across seven countries, and that infected modems were disconnected from the service. The United States froze USD 3.5 million in cryptocurrency. Authorities linked roughly 363,000 IP addresses in 163 countries to the service since 2020; Lumen Technologies said SocksEscort averaged about 20,000 distinct victims weekly.
Malware
Vendors
Cisco“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.D-Link“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.Hikvision“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.MicroTik“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.NETGEAR“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.TP-Link“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.Zyxel“SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.