European and U.S. authorities have announced the dismantling of a major malicious proxy operation tied to malware-infected home and small-business routers, freezing $3.5 million in cryptocurrency and seizing infrastructure used to support fraud.

Europol said the March 11 action, named Operation Lightning, targeted the “SocksEscort” service, which it said had compromised over 369,000 routers and Internet of Things devices across 163 countries and offered users more than 35,000 proxies in recent years.

According to Europol, law enforcement seized 34 domains and 23 servers across seven countries, while U.S. authorities froze $3.5 million in crypto linked to the case. Europol also said that a payment platform linked to the service is estimated to have received more than $5.7 million (€5 million) in cryptocurrency.

The investigation, which began in June 2025 under Europol’s Joint Cyberaction Task Force, uncovered a botnet of infected devices, mainly residential routers, exploited to facilitate criminal activities including ransomware, DDoS attacks, and the distribution of child sexual abuse material.

In a parallel announcement, the U.S. Attorney’s Office for the Eastern District of California said that the SocksEscort application had listed about 8,000 infected routers as of February 2026, including around 2,500 in the United States. U.S. law enforcement alleged that criminals used proxy access to mask origin locations for schemes including bank and crypto account takeovers and fraudulent unemployment claims.

Federal prosecutors cited multiple alleged victim losses, including a New York crypto exchange customer reportedly defrauded of $1 million in digital assets, a Pennsylvania manufacturer that allegedly lost $700,000, and current and former military service members allegedly defrauded of $100,000.



“By dismantling this infrastructure, law enforcement has disrupted a service that enabled cybercrime on a global scale,” Europol Executive Director Catherine De Bolle said in a statement, adding that, “Operations like this show that when investigators connect the dots internationally, the infrastructure behind cybercrime can be exposed and shut down.”

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。