Law enforcement shuts down botnet made of tens of thousands of hacked routers

In a significant global operation, law enforcement agencies have successfully dismantled a massive botnet consisting of tens of thousands of compromised home and small business routers. This coordinated effort, which took place on Wednesday, primarily targeted a network known as SocksEscort, infamous for providing illicit proxy services powered by a vast array of hacked devices. According to an announcement from the Justice Department, the SocksEscort botnet was responsible for numerous cybercrimes, including unauthorized access to victims' bank and cryptocurrency accounts and fraudulent unemployment claims. The financial toll on American citizens due to these crimes is estimated to be in the millions. Europol reported that SocksEscort had compromised over 369,000 routers and Internet of Things devices across 163 countries, with the infected devices now disconnected from service. The botnet was reportedly utilized for various malicious activities, including ransomware attacks, distributed denial of service (DDoS) assaults, and the dissemination of child sexual abuse material (CSAM). Europol highlighted that customers of this criminal network paid for licenses to exploit these compromised devices, allowing them to mask their true IP addresses while engaging in illegal activities. Most modem owners remained unaware that their devices were being used for such nefarious purposes. As part of the crackdown, the official SocksEscort website has been replaced with a notice announcing its seizure. Since January, the botnet has been estimated to involve around 280,000 routers, with its operations facilitated by malware known as AVRecon. Cybersecurity firm Black Lotus Labs, which monitored SocksEscort's activities and collaborated with law enforcement during the takedown, underscored the serious threat posed by this botnet, which was exclusively marketed to criminals. Notably, more than half of SocksEscort's victims were situated in the United States and the United Kingdom, enabling attackers to carry out highly targeted cyber operations. In 2023, Black Lotus Labs characterized SocksEscort as one of the largest botnets targeting small-office/home-office (SOHO) routers in recent history. Its origins trace back to 2009, when it started as a Russian-language service selling access to a multitude of compromised computers.