Loading malware…
SocksEscort is a malicious residential proxy service and botnet operation that compromised large numbers of routers worldwide and repurposed them as proxy infrastructure for cybercrime. It is associated with the abuse of residential network devices to relay attacker traffic through victim internet connections, enabling anonymity and supporting downstream criminal activity. Public reporting links the operation to digital fraud at significant scale and notes that international law enforcement disrupted the service in a coordinated takedown.
SocksEscort is notable less for direct destructive or data-theft functionality on the infected device than for turning compromised routers into covert relay nodes. This proxying capability allows operators or customers to route malicious traffic through legitimate residential endpoints, obscuring origin and facilitating fraud and other follow-on operations. The campaign affected hundreds of thousands of residential routers, illustrating the persistent security risk posed by internet-exposed and poorly maintained edge devices.
The available information supports classifying SocksEscort as botnet-backed proxy malware targeting router and embedded network infrastructure. It has been referenced alongside other router-focused malware and proxy botnet campaigns that exploit neglected edge devices as covert operational infrastructure. High-confidence public facts do not establish a specific initial infection vector for SocksEscort in the supplied material beyond compromise of routers at scale.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
AryStinger follows the same pattern seen in campaigns such as AVrecon, SocksEscort, and TheMoon.
A proxy service leveraging compromised residential routers at scale.
A residential proxy service leveraging compromised routers worldwide to mask criminal activity and facilitate digital fraud.
Mentioned as a named malicious network or cybercrime tool disrupted during recent law enforcement operations, with no additional detail in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.