Global takedown of router botnet revealed

A significant global operation has successfully shut down the SocksEscort botnet, a network comprised of tens of thousands of compromised home and small business routers. This botnet was used to offer paid proxy services, enabling criminals to hide their identities while engaging in illicit activities.

The compromised devices, numbering over 369,000 across 163 countries, facilitated serious crimes. These included hacking into bank and cryptocurrency accounts, filing fraudulent unemployment claims, ransomware attacks, and the distribution of child sexual abuse material. The Justice Department indicated that these criminal activities resulted in millions of dollars in losses for Americans.

The takedown was a collaborative effort involving multiple law enforcement agencies. Cybersecurity firm Black Lotus Labs, which had been tracking SocksEscort since January, assisted in the operation. The malware powering the botnet, known as AVRecon, has been neutralized, and the infected routers have been disconnected from the service, effectively ending the threat posed by this extensive network.