Law enforcement shuts down botnet made of tens of thousands of hacked routers

A global coalition of law enforcement agencies shut down a botnet made of tens of thousands of hacked home and small business routers on Wednesday.

The operation targeted SocksEscort, which offered paid proxy services and was built on a botnet of hacked routers used to commit various crimes, such as hacking into victims’ bank and cryptocurrency accounts, and to file fraudulent unemployment insurance claims, according to an announcement published on Thursday by the Justice Department. The DOJ said the crimes facilitated by SocksEscort cost Americans millions of dollars.

Europol said in its announcement of the operation that the SocksEscort botnet allegedly compromised more than 369,000 routers and Internet of Things devices in 163 countries, and that the infected routers “have been disconnected from the service.” The law enforcement agency said SocksEscort was used to facilitate ransomware, distributed denial of service (DDoS) attacks, and the distribution of child sexual abuse material (CSAM).

“Customers of the criminal service paid for licences to abuse these infected devices, hiding their original IP addresses to engage in various criminal activities,” said Europol. “Upon infection with the malware, the modems’ owners would not be aware that their IP addresses were used for illegitimate activities.”

The content of the SocksEscort official website was replaced by a notice announcing the seizure, as part of the law enforcement operation.

The botnet was composed of around 280,000 routers since last January, and was powered by malware called AVRecon, according to cybersecurity firm Black Lotus Labs, which tracked SocksEscort and worked with law enforcement in the takedown operation

“This botnet posed a significant threat, as it was marketed exclusively to criminals,” the company wrote in its post about the takedown. “Notably, over half of its victims were located in the United States or the United Kingdom, enabling attackers to conduct highly targeted operations.”

In 2023, Black Lotus Labs called SockEscort “one of the largest botnets targeting small-office/home-office (SOHO) routers seen in recent history.”

At the time, cybersecurity journalist Brian Krebs reported that SocksEscort was born in 2009 as a Russian-language service selling access to thousands of hacked computers.

Topics

Senior Reporter, Cybersecurity

Lorenzo Franceschi-Bicchierai is a Senior Writer at TechCrunch, where he covers hacking, cybersecurity, surveillance, and privacy.

You can contact or verify outreach from Lorenzo by emailing lorenzo@techcrunch.com, via encrypted message at +1 917 257 1382 on Signal, and @lorenzofb on Keybase/Telegram.

Actively scaling? Fundraising? Planning your next launch?TechCrunch Founder Summit 2026 delivers tactical playbooks and direct access to 1,000+ founders and investors who are building, backing, and closing.Register by March 13 to save up to $300.

DOGE employee stole Social Security data and put it on a thumb drive, report says

Meta acquired Moltbook, the AI agent social network that went viral because of fake posts

Google rolls out new Gemini capabilities to Docs, Sheets, Slides, and Drive

Yann LeCun’s AMI Labs raises $1.03B to build world models

Anthropic launches code review tool to check flood of AI-generated code

A roadmap for AI, if anyone will listen

OpenAI hardware exec Caitlin Kalinowski quits in response to Pentagon deal