Operation Lightning Takedown of SocksEscort Residential Proxy Botnet

An international law-enforcement operation dubbed Operation Lightning disrupted SocksEscort, a paid “residential proxy” service that routed criminal traffic through compromised home/small-business routers and IoT devices to provide anonymity for fraud and other cybercrime. Authorities from the US and multiple European countries (including Austria, France, and the Netherlands), supported by Europol and Eurojust and assisted by private-sector partners Lumen’s Black Lotus Labs and the Shadowserver Foundation, reported the botnet had leveraged exploited vulnerabilities in edge devices and was powered by AVRecon (Linux) malware. Officials said SocksEscort advertised access to roughly 369,000 IP addresses since 2020, with Europol stating the infrastructure compromised 369,000+ routers/IoT devices across 163 countries and offered customers tens of thousands of proxies; reporting also noted that, as of February 2026, the service listed about 8,000 infected routers, including roughly 2,500 in the United States.

During the coordinated action, authorities seized 34 domains and 23 servers across seven countries, replaced the service’s website with a seizure notice, and the US froze approximately $3.5 million in cryptocurrency tied to the operation; officials also cited the service’s payment platform receiving about $5.8 million from customers. SocksEscort was described as enabling a wide range of downstream criminal activity—including large-scale fraud, account takeovers, identity theft, business email compromise, password spraying, and, per Europol, facilitation of ransomware, DDoS, and distribution of CSAM—with US reporting citing specific victim losses (including a $1M cryptocurrency theft and additional six-figure fraud impacts). Investigators indicated the seized infrastructure and customer data (reported as roughly 124,000 users) will be used to pursue follow-on investigations into both operators and customers of the proxy service.