Europol and law enforcement partners in Europe and the United States say they have disrupted a malicious online proxy service called SocksEscort after an operation that targeted infrastructure used to route criminals’ internet traffic through hacked home devices.
The coordinated action, carried out on 11 March, involved authorities in Austria, France, the Netherlands and the US, with support from Eurojust, the EU agency that helps prosecutors and judges work across borders, Europol announced on Thursday.
Investigators said SocksEscort had allegedly compromised more than 369,000 routers and Internet of Things devices in 163 countries, and offered customers access to more than 35,000 proxies in recent years.
A proxy is a service that relays a user’s internet connection through another device, which can help conceal where online activity is coming from.
During the action day, authorities took down and seized 34 domains and 23 servers located across seven countries.
The US also froze USD 3.5 million in cryptocurrency.
How the service worked
The investigation began in June 2025 after Europol’s Joint Cyberaction Task Force opened a case.
The compromised devices — mainly residential routers — were infected via a vulnerability in the residential modems of a specific brand, before being used as part of a botnet, a network of infected devices controlled remotely.
Europol said the infected devices were used to facilitate criminal activity including ransomware, distributed denial-of-service (DDoS) attacks, and the distribution of child sexual abuse material.
Customers paid for licences to use the infected devices as proxies in order to hide their original IP addresses.
The compromised modems used to provide the proxy service have been disconnected, and authorities plan to alert affected countries following the takedown.
