A New York resident lost nearly $1 million in cryptocurrency. This single case became one of the clearest examples of the damage caused by SocksEscort – a proxy-for-hire service that gave criminals around the world a way to hide while stealing.
A network built on stolen devices
U.S. and European authorities announced Thursday that they are shutting down SocksEscort after several years in business. The service worked by infecting routers and other internet-connected devices with malware, turning them into hotspots that masked the true location of cybercriminals.
According to the Department of Justice, the network quietly infiltrated at least 369,000 devices spread across 163 countries. Criminals could then direct their attacks through those compromised vehicles, making them much harder to trace.
The operations center malware, known as AVrecon, was publicly identified by cybersecurity firm Black Lotus Labs by July 2023. The network still worked.
Source: DOJ
The dismissal was not an agency effort. Law enforcement agencies from Austria, France, Germany, Hungary, the Netherlands, Romania and the US worked together on the case.
On the US side, the FBI’s Sacramento Field Office, the Oakland IRS Office of Criminal Investigation, and the Department of Defense’s Criminal Investigative Service are all involved.
Europol and Eurojust provided cross-border coordination support. Black Lotus Labs and the nonprofit Shadowserver Foundation provided technical information that helped investigators connect the dots.
Criminals have paid in crypto to remain anonymous
SocksEscort didn’t just attract individual bad actors. It worked like a business. Customers paid to access the service, and they did so anonymously – using cryptocurrency to avoid a financial footprint.
According to reports by Europol, the platform earned at least 5 million euros, about 5.7 million dollars, from its paying users during its lifetime.
Authorities were eventually able to seize 34 domains, shut down nearly two dozen servers operating in seven countries, and freeze approximately $3.5 million in crypto associated with the operation.
Europol Executive Director Catherine De Bolle said proxy services allow such criminals to carry out attacks, transmit illegal content and evade detection. He appreciated international cooperation to expose the infrastructure behind it.
Fraud has spread from bank accounts to crypto wallets
The crimes made possible by SocksEscort were beyond any single method. Officials have linked the network to bank fraud and the seizure of cryptocurrency accounts dating back to 2020.
The New York casualty case was different in scale, but reports indicate that the damage was spread across countries and target species.
Featured image from Pexels, chart from TradingView
Editing process because bitcoinist is committed to delivering thoroughly researched, accurate and unbiased content. We adhere to strict sourcing standards and every page is rigorously reviewed by a team of top technology experts and experienced editors. This process ensures the integrity, relevance and value of our content to our readers.
