U.S. and European Authorities Disrupt SocksEscort Proxy Network Powered by AVRecon
Summary
Authorities disrupted SocksEscort, a proxy service using AVRecon-infected routers, seizing 34 domains and 23 servers and freezing $3.5 million in cryptocurrency. The DOJ linked the service to several thefts and frauds.
Key points
- U.S. and European authorities, with private-sector partners, disrupted SocksEscort, which routed customers’ traffic through compromised edge devices.
- Lumen’s Black Lotus Labs reported an average of about 20,000 infected devices weekly over several years; the DOJ said the application listed about 8,000 infected routers in February 2026.
- Authorities seized 34 domains and 23 servers across seven countries; the U.S. froze $3.5 million in cryptocurrency.
- The DOJ linked SocksEscort to a $1 million cryptocurrency theft, $700,000 in losses at a Pennsylvania manufacturing business, and $100,000 in MILITARY STAR card fraud.
- Lumen attributed the proxy network’s growth to AVRecon, which had infected more than 70,000 Linux SOHO routers by mid-2023. Devices used in SocksEscort have been disconnected from the service.
- The article also notes KadNap’s targeting of ASUS routers and other edge devices, and recommends firmware updates, replacing end-of-life routers, changing default passwords, and disabling unnecessary remote access.
Article Details
- Event Type
- Law enforcement disruption of the SocksEscort criminal proxy network and its supporting infrastructure.
- Impact
- Authorities seized 34 domains and 23 servers, and the United States froze $3.5 million in cryptocurrency. The DOJ attributed a $1 million cryptocurrency theft, $700,000 in losses at a Pennsylvania manufacturing business, and $100,000 in MILITARY STAR card fraud damages to use of the service. The infected devices used by SocksEscort have been disconnected. Lumen researchers reported an average of about 20,000 infected devices weekly and said AVRecon had infected over 70,000 Linux-based SOHO routers by mid-2023.
Malware
Vendors
Countries
AustriaIn Europe, authorities in Austria, France, and the Netherlands, took down multiple SocksEscort servers under the coordination of Europol.FranceIn Europe, authorities in Austria, France, and the Netherlands, took down multiple SocksEscort servers under the coordination of Europol.NetherlandsIn Europe, authorities in Austria, France, and the Netherlands, took down multiple SocksEscort servers under the coordination of Europol.United KingdomOver half of the infected devices were located in the United States and the United Kingdom, according to the researchers, which is excellent for routing malicious traffic and evading blocklists.United StatesEuropol and U.S. agencies seized domains and servers, froze $3.5 million in crypto, and disconnected the network’s infected devices.