Loading story…
Researchers tied the Linux-based AVrecon remote access trojan to SocksEscort, a long-running proxy-for-rent service that monetized hacked residential and small-business devices. Black Lotus Labs described AVrecon as a major botnet targeting SOHO routers and said it had supported residential proxying, password spraying, web-traffic proxying, and ad fraud since at least mid-2021. Spur correlated AVrecon command-and-control infrastructure with SocksEscort callback systems and concluded that the botnet supplied the compromised endpoints rented through the proxy network.
The operation appeared to suffer a major disruption after Black Lotus Labs published its findings, with Spur observing a sharp drop in available proxy endpoints and victim counts after stage-two command-and-control IPs were reportedly blackholed. KrebsOnSecurity reported that the operators responded by blocking traffic and moving infected devices to new infrastructure, while also tracing SocksEscort through earlier proxy brands, forum identities, and a Moldova-linked network connected to domains, proxy-testing services, and a commercial VPN business.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On July 25, Krebs published an investigation tracing SocksEscort's history and suggesting ties to a Moldova-linked operation. The report linked the service to an individual, related proxy-testing domains, and a VPN app business.
Following Lumen's blocking action on July 13, the operators reacted quickly by moving infected systems to new command-and-control infrastructure. Lumen said the shift appeared aimed at preserving botnet control and revenue.
After publishing its AVrecon research, Lumen began blocking traffic to the malware's control servers on July 13. Spur assessed that Lumen's blackholing of stage-two C2 infrastructure explained the collapse in SocksEscort proxy inventory.
On July 12, Black Lotus Labs published research describing AVrecon as a major SOHO-router botnet. The report detailed its use for residential proxying and other malicious activity.
Around July 11, Spur observed a significant downward trend in available SocksEscort endpoints, with the online proxy count roughly halved. Spur also saw victim counts per SocksEscort server drop to zero while proxy control servers still appeared online.
Danny Adamitis of Lumen confirmed that Spur's findings on SocksEscort infrastructure matched Lumen's AVrecon command-and-control data dating back to September 2022. This anchored the linkage between the botnet and the proxy service to at least that month.
Lumen said AVrecon had largely evaded public attention since it was first spotted in mid-2021. The botnet was used for residential proxying, password spraying, web-traffic proxying, and ad fraud.
Krebs reported that SocksEscort began in 2009 as the Russian-language proxy service super-socks[.]com. The SSC/super-socks identity promoted the service on multiple cybercrime forums.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
spur.us
Open sourcekrebsonsecurity.com
Open sourceblog.lumen.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law-enforcement operation dubbed **Operation Lightning** disrupted **SocksEscort**, a paid “residential proxy” service that routed criminal traffic through compromised home/small-business routers and IoT devices to provide anonymity for fraud and other cybercrime. Authorities from the US and multiple European countries (including Austria, France, and the Netherlands), supported by **Europol** and **Eurojust** and assisted by private-sector partners **Lumen’s Black Lotus Labs** and the **Shadowserver Foundation**, reported the botnet had leveraged exploited vulnerabilities in edge devices and was powered by **AVRecon** (Linux) malware. Officials said SocksEscort advertised access to roughly **369,000 IP addresses** since 2020, with Europol stating the infrastructure compromised **369,000+** routers/IoT devices across **163 countries** and offered customers tens of thousands of proxies; reporting also noted that, as of February 2026, the service listed about **8,000 infected routers**, including roughly **2,500 in the United States**. During the coordinated action, authorities **seized 34 domains and 23 servers** across **seven countries**, replaced the service’s website with a seizure notice, and the US froze approximately **$3.5 million in cryptocurrency** tied to the operation; officials also cited the service’s payment platform receiving about **$5.8 million** from customers. SocksEscort was described as enabling a wide range of downstream criminal activity—including large-scale fraud, account takeovers, identity theft, business email compromise, password spraying, and, per Europol, facilitation of **ransomware**, **DDoS**, and distribution of **CSAM**—with US reporting citing specific victim losses (including a **$1M** cryptocurrency theft and additional six-figure fraud impacts). Investigators indicated the seized infrastructure and customer data (reported as roughly **124,000 users**) will be used to pursue follow-on investigations into both operators and customers of the proxy service.
Jun 29, 2026
Researchers disclosed **SockDetour**, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates **filelessly** and **socketlessly**, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least **July 2019**. Unit 42 linked the activity to the China-linked **TiltedTemple** cluster, also tracked by Microsoft as **DEV-0322**, and said the campaign overlapped with late-2021 intrusions involving **Zoho ManageEngine** exploitation; reporting also noted possible ties to **APT27** based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised **QNAP NAS** device that had likely been exploited through **`CVE-2021-28799`**, the same flaw previously abused to deploy **eCh0raix** and associated with earlier **QLocker** ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Aug 15, 2026
Nokia Deepfield researchers reported that the **Jackskid** DDoS botnet, the **peer4you-mirai** hybrid malware, and the **trees4sale** residential proxy service are linked to a single operator that abuses **UPnP Internet Gateway Device** port mapping to expose infected residential devices directly to the internet. Instead of routing traffic through outbound tunnels, the malware opens about **165 external router ports** marked **"RELAY"**, converting compromised home devices into proxy exits. The report ties the operations together through shared relay code, a byte-identical `RCtea` configuration key, overlapping infrastructure, and cryptocurrency wallets funded by the same upstream source. The research says **peer4you-mirai** connects the DDoS and proxy activity, while newer Jackskid variants either deploy the relay as a second Android payload or embed it directly into Linux bot binaries. In addition to DDoS and proxy services, the operator reportedly uses compromised residential devices as a rotating **C2 relay mesh** populated from a `/nodes` director. The technique builds on the long-observed **UPnProxy** abuse pattern, but the newer campaign operationalizes it at scale for botnet control and commercial proxying. Defenders were urged to watch for **SSDP discovery**, SOAP `AddPortMapping` requests, and NAT entries whose description is **"RELAY"**, which the researchers described as strong indicators of compromise.
Aug 14, 2026