International law enforcement from eight countries, including the FBI, dismantled SocksEscort, a residential proxy service responsible for tens of millions of dollars in fraud. Operation Lightning seized 34 domains and 23 servers across seven countries and froze approximately $3.5 million in cryptocurrency. SocksEscort operated by infecting home and small business routers with the AVRecon botnet, selling access to roughly 369,000 compromised IP addresses since 2020. The service had around 124,000 customers and enabled crimes including ransomware, ad fraud, account takeovers, identity theft, and romance scams. Private-sector partners Lumen's Black Lotus Labs and the Shadowserver Foundation assisted in the takedown.
Sort: