The DOJ and Europol have dismantled SocksEscort, a residential proxy network used to mask the origins of cyberattacks and crypto fraud. Authorities seized 34 domains, took 23 servers offline across seven countries and froze about $3.5 million in cryptocurrency. Investigators say the network infected roughly 369,000 devices with AVRecon malware, generated an estimated $5.8 million over its lifetime, and had about 124,000 registered users now exposed to potential indictments.
DOJ and Europol Take Down SocksEscort: Major Residential Proxy Network Linked to Crypto Crimes Dismantled
The U.S. Department of Justice and Europol have dismantled SocksEscort, a long-running residential proxy network that investigators say enabled account takeovers, ransomware campaigns and crypto fraud by hiding attackers' true origins.
Operation Details
Authorities seized 34 domains and took 23 servers offline across seven countries as part of a coordinated international effort known as Operation Lightning. Investigators also froze roughly $3.5 million in cryptocurrency tied to the service.
How the Network Operated
According to law enforcement, SocksEscort relied on AVRecon malware to compromise devices — including home routers, IoT devices and residential IP addresses — creating a pool of about 369,000 infected endpoints across 163 countries. These compromised IPs were rented to criminals who used them as “clean” traffic to bypass IP-based fraud controls at banks and crypto exchanges.
Scale, Revenue and Recent Growth
Investigators estimate the network generated about $5.8 million over its lifetime. Since early 2024, roughly 20,000 new devices were added to the botnet each week, accelerating the pool available to illicit actors. SocksEscort reportedly had about 124,000 registered users who posed as legitimate residential traffic to evade fraud detection.
Evidence and Legal Fallout
With servers now in law enforcement custody, transaction logs and other forensic evidence are available to investigators. FBI Deputy Assistant Director Jason Bilnoski confirmed that thousands of users are exposed and said downstream indictments are expected as probes continue.
Broader Implications
Europol’s executive director described proxy services like SocksEscort as an “anonymity shield” that lets illicit funds move across borders without detection. Removing that shield disrupts the criminal ecosystem. Exchanges and other platforms now face added pressure to distinguish legitimate privacy measures from criminal evasion infrastructure and to verify that traffic originates from bona fide ISPs rather than compromised devices.
The takedown marks the end of a decade-long operation and begins a new phase of forensic analysis and prosecutions as authorities follow the trail left by the network.
Help us improve.
