A coordinated international law enforcement operation has taken down SocksEscort, a major proxy network used to facilitate a wide range of cybercrimes. The U. S. Department of Justice, in collaboration with Europol and other agencies, announced the disruption of the network, which had compromised over 369,000 routers and IoT devices across 163 countries. Authorities have seized 34 domains and 23 servers located in seven countries and frozen approximately $3.5 million in cryptocurrency linked to the network.
SocksEscort operated by infecting home and small business routers with malware, allowing cybercriminals to route internet traffic through these compromised devices. This enabled them to conceal their true IP addresses and locations, making it easier to carry out fraud schemes. These schemes included takeovers of U. S. bank and cryptocurrency accounts, as well as fraudulent unemployment insurance claims. One New York resident reportedly lost $1 million in cryptocurrency due to the scheme.
Europol's Executive Director, Catherine De Bolle, emphasized the importance of dismantling such infrastructure, stating that "Proxy services like 'SocksEscort' provide criminals with the digital cover they need to launch attacks, distribute illegal content, and evade detection". The investigation, which began in June 2025, revealed that the infected devices were also used to facilitate ransomware attacks and DDoS attacks.
To protect against such exploits, users and vendors are advised to regularly update the firmware of their devices. The takedown of SocksEscort represents a significant step in the fight against cybercrime, disrupting a service that enabled criminal activities on a global scale. The investigation is ongoing, with officials planning to notify affected countries about the compromised devices to support further investigations.
