Loading malware…
SocksEscort is a long-running malware-backed residential proxy service that monetizes large numbers of compromised edge devices, especially residential and small-office routers. It has been associated with botnet activity affecting hundreds of thousands of routers worldwide and has been used to provide proxy infrastructure for cybercriminal operations, including digital fraud. Security reporting has linked SocksEscort to AVrecon, a SOHO-focused malware botnet, through overlapping command-and-control infrastructure, indicating that infected routers were enrolled and then resold or abused as proxy nodes.
Operationally, SocksEscort turns compromised routers into intermediary systems that relay traffic through victims’ residential or business internet connections, helping operators and customers conceal origin and blend malicious activity with legitimate network space. This places it in the broader category of covert proxy networks built from neglected internet-facing devices. The service has been discussed alongside other router-focused malware and proxy ecosystems that exploit unsupported or poorly maintained edge infrastructure.
SocksEscort primarily targets network edge devices rather than traditional endpoints. Available reporting supports its role as a malware-enabled proxy network and monetization layer, but does not provide high-confidence detail on its exact initial infection vectors within this dataset. Law enforcement and private-sector disruption efforts have significantly degraded the service at times by targeting supporting infrastructure, sharply reducing available proxy inventory.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
The proxy control servers appeared to still be online ... The smoking gun was in Lumen's remediation ... black hole-ing the IP addresses belonging to the stage 2 C2 infrastructure for AVrecon.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
AryStinger follows the same pattern seen in campaigns such as AVrecon, SocksEscort, and TheMoon.
A proxy service leveraging compromised residential routers at scale.
A residential proxy service leveraging compromised routers worldwide to mask criminal activity and facilitate digital fraud.
Mentioned as a named malicious network or cybercrime tool disrupted during recent law enforcement operations, with no additional detail in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.