U.S. and European Authorities Disrupt SocksEscort Proxy Network
Summary
Law enforcement in seven countries disrupted SocksEscort, seizing 34 domains and 23 servers and freezing $3.5 million in cryptocurrency. The FBI linked the service to AVRecon-infected routers sold as residential proxies.
Key points
- Authorities in seven countries seized 34 domains and took down 23 servers in an operation that began in June 2025.
- U.S. officials froze access to $3.5 million in cryptocurrency.
- The Justice Department said SocksEscort offered access to about 369,000 IP addresses across 163 countries from 2020 to 2026; about 8,000 were listed for sale in February.
- The FBI said AVRecon targets about 1,200 router and IoT device models, whose infected devices were sold as residential proxies through SocksEscort.
- Court documents linked the service to fraudulent unemployment claims, cryptocurrency theft and U.S. bank-account takeovers; its operators allegedly earned more than $5.7 million.
- Black Lotus Labs reported that the platform averaged about 20,000 distinct victims weekly and communicated through an average of 15 command-and-control nodes.
Article Details
- Event Type
- Law-enforcement disruption and takedown of the SocksEscort residential proxy network, alongside an FBI alert about AVRecon malware targeting routers and IoT devices.
- Impact
- Authorities in seven countries seized 34 domains, took down 23 servers, and U.S. officials froze $3.5 million in cryptocurrency. The DOJ said SocksEscort offered access to about 369,000 IP addresses across 163 countries from 2020 to 2026; about 8,000 were listed as available in February, including 2,500 in the U.S. Black Lotus Labs reported an average of about 20,000 distinct victims weekly and 15 command-and-control nodes. The FBI linked AVRecon-infected routers to SocksEscort proxy sales. Court documents connected the service to fraudulent unemployment claims, cryptocurrency theft, and U.S. bank account takeovers; its operators allegedly earned more than $5.7 million.
MITRE ATT&CK
People
Malware
Vendors
CiscoThe FBI warned that AVRecon malware targets routers and IoT devices across many models from vendors like Cisco, DâLink, MicroTik, Netgear, TPâLink, Hikvision and Zyxel, and investigators tied the platform toD-LinkSocksEscort uses AVrecon malware “to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.Hikvisionand IoT devices across many models from vendors like Cisco, DâLink, MicroTik, Netgear, TPâLink, Hikvision and Zyxel, and investigators tied the platform to widespread fraud and theft.MicroTikAVRecon malware targets routers and IoT devices across many models from vendors like Cisco, DâLink, MicroTik, Netgear, TPâLink, Hikvision and Zyxel, and investigators tied the platform to widespread fraud andNETGEARmalware targets routers and IoT devices across many models from vendors like Cisco, DâLink, MicroTik, Netgear, TPâLink, Hikvision and Zyxel, and investigators tied the platform to widespread fraud and theft.TP-LinkSocksEscort uses AVrecon malware “to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said.Zyxeldevices across many models from vendors like Cisco, DâLink, MicroTik, Netgear, TPâLink, Hikvision and Zyxel, and investigators tied the platform to widespread fraud and theft.
Countries
AustriaLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.BulgariaLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.FranceLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.GermanyLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.HungaryLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.NetherlandsLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.RomaniaLaw enforcement agencies in Austria, France and the Netherlands took down SocksEscort servers and officials in Bulgaria, Germany, Hungary and Romania were involved in the investigation, which began in June 2025.United StatesLaw enforcement in the U.S.