The Botnet That Turned Home Routers Into Criminal Proxies | SocksEscort

Thousands of ordinary home and small-business routers were secretly turned into residential proxies—and sold to cybercriminals. The service, known as SocksEscort, let customers route their internet traffic through compromised devices, hiding their real IP addresses behind connections that looked like ordinary households. U.S. authorities say the network offered access to about 369,000 different IP addresses over time and was used to support fraud, including bank and cryptocurrency account takeovers. In March 2026, an international law enforcement operation disrupted the service. But taking down the marketplace did not necessarily remove malware from every infected router. This is the story of SocksEscort, the AVrecon malware behind it, and the criminal infrastructure hiding inside everyday internet connections. Sources: U.S. Department of Justice: https://www.justice.gov/usao-edca/pr/... FBI technical alert: https://www.ic3.gov/CSA/2026/260312.pdf Lumen Black Lotus Labs: https://www.lumen.com/blog/en-us/rout...