Who and What is Behind the Malware Proxy Service Socks Escort?
Summary: Researchers at Lumen's Black Lotus Labs reported that AVrecon, a Linux-based remote access trojan first spotted in mid-2021, enslaves Internet routers into a botnet used for password spraying, web-traffic proxying and ad fraud. Spur.us found that the command-and-control servers Lumen tagged for AVrecon all tie back to SocksEscort, a 12-year-old SOCKS proxy service that rents more than 10,000 hacked devices worldwide to customers who install a Windows application to access them.
What you should know: Lumen could not determine how the SOHO routers were infected, and the day after it began blocking traffic to the botnet's control servers the operators moved infected systems to new infrastructure to keep the revenue stream going.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026