International Operation Dismantles SocksEscort Botnet

International law enforcement agencies disrupted SocksEscort, a malicious residential proxy network that compromised hundreds of thousands of routers and Internet of Things devices worldwide, in a coordinated operation on March 11, 2026. The action, known as Operation Lightning, involved authorities from the United States, Austria, France, the Netherlands and other European nations, resulting in the seizure of 34 domains and 23 servers across seven countries, along with the freezing of approximately 3.5 million dollars in cryptocurrency linked to the network.

The U.S. Department of Justice led the effort, with support from Europol and Eurojust, which hosted a virtual command post in The Hague to coordinate the takedown. Researchers from Lumen Technologies' Black Lotus Labs and the Shadowserver Foundation provided key technical assistance in identifying and dismantling the infrastructure. Officials disconnected the infected devices from the service and plan to notify affected users and countries to aid further investigations.

SocksEscort operated as a botnet powered by AVRecon malware, which exploited vulnerabilities in routers and IoT devices from manufacturers including Cisco,...