Dutch Police Takedown Hits 17 Million-Device Botnet Linked to Proxy Abuse

Dutch police and the Netherlands’ National Cyber Security Center disrupted a botnet spanning roughly 17 million infected devices by taking offline about 200 servers hosted in the Netherlands. Authorities said the network included compromised computers, mobile phones, IoT devices, and routers, and that the investigation began after a security researcher alerted NCSC-NL. While officials did not publicly name the botnet, reporting tied the infrastructure to Asocks, a commercial residential and mobile proxy service, and to prior research on covert proxy enrollment through the PROXYLIB library and LumiApps SDK ecosystem.

The takedown highlights growing abuse of residential proxy networks, which can mask malicious traffic behind trusted consumer IP addresses and support operations including DDoS attacks, spam, credential stuffing, brute-force attacks, click fraud, SMS pumping, phishing, online fraud, and malware delivery. The action follows broader Dutch enforcement against malicious infrastructure, including the seizure of more than 800 servers tied to THE.Hosting, a Russian-linked bulletproof hosting network associated with scanning, botnet recruitment, cryptomining, credential theft, and exploitation of exposed services; researchers said that operation had limited effect because much of the network’s routed infrastructure remained active across multiple countries.