European and US authorities have dismantled the “SocksEscort” malicious proxy network and frozen $3.5 million in cryptocurrency linked to the operation as part of a coordinated cybercrime crackdown.
Europol said the action, called Operation Lightning, targeted a network that allegedly infected more than 369,000 routers and internet-connected devices across 163 countries while offering more than 35,000 proxy connections to criminals.
Investigators seized 34 domains and 23 servers across seven countries, while US authorities froze $3.5 million in crypto and identified a payment platform connected to the service that processed more than $5.7 million in digital assets.
The investigation began in June 2025 under Europol’s Joint Cyberaction Task Force and uncovered a botnet of compromised residential routers used to facilitate crimes including ransomware attacks, distributed denial-of-service attacks and other online fraud.
US Department of Justice said criminals used the proxy service to hide their locations while carrying out schemes such as bank and cryptocurrency account takeovers and fraudulent unemployment claims.
Prosecutors cited several alleged victims, including a New York crypto exchange customer reportedly defrauded of $1 million in digital assets and a Pennsylvania manufacturer that lost about $700,000.
“By dismantling this infrastructure, law enforcement has disrupted a service that enabled cybercrime on a global scale,”
Said Europol Executive Director, Catherine De Bolle.