European and US agencies dismantled the SocksEscort proxy network built on infected routers and used by cybercriminals in global fraud schemes.

A coordinated international law enforcement operation has dismantled SocksEscort (socksescort.com), a large proxy service that routed cybercriminal traffic through thousands of compromised home and small business routers around the world.

The seizure, announced by the FBI and the US Department of Justice (DOJ), resulted in the seizure of dozens of internet domains and servers, along with the freezing of millions of dollars in cryptocurrency linked to the operation.

SocksEscort functioned like any other proxy service online, where customers paid to route their internet traffic through remote IP addresses. However, investigators say the infrastructure behind the service relied on malware that infected residential routers, turning them into tools for cybercrime without their owners’ knowledge.

According to the DoJ’s press release, the service deployed backdoors on routers used in homes and small businesses. Once infected, those devices could ...