SocksEscort Proxy Cracked Down

In a significant international law enforcement operation, Europol, along with agencies from multiple countries, successfully disrupted the notorious ‘SocksEscort’ proxy service, as confirmed in a recent announcement. The coordinated crackdown, dubbed Operation Lightning, took place on March 11, 2026, targeting the service accused of exploiting hundreds of thousands of residential routers and IoT devices globally.

The operation saw the seizure of 34 domain names and 23 servers across seven countries, effectively dismantling a network that had compromised over 369,000 devices in 163 countries. Additionally, U.S. authorities froze approximately USD 3.5 million in cryptocurrency linked to the network. This decisive action disconnected the infected devices, removing them from the criminal network and marking a significant blow to cybercriminal operations worldwide.

Europol’s Joint Cyberaction Task Force (J-CAT) initiated the investigation in June 2025, uncovering a complex botnet that facilitated a range of illegal activities, including ransomware distribution and DDoS attacks. The botnet was orchestrated through a vulnerability in specific residential modems, allowing criminals to mask their identities using the infected IP addresses. This operation highlights the critical role of international cooperation in tackling cybercrime, with significant contributions from Austria, France, the Netherlands, the USA, and several other European nations.

The crackdown not only neutralizes a major cyber threat but also paves the way for further investigations, as affected countries are alerted and preventive measures are reinforced. This includes advisories for regular firmware updates by users and vendors to shield against similar exploits. The operation underscores the importance of collaborative efforts in confronting increasingly sophisticated digital crimes, ensuring a safer cyber environment for users worldwide.