Loading malware…
SocksEscort is a long-running malware-backed residential proxy service that monetizes large numbers of compromised edge devices, especially residential and small-office routers. It has been associated with botnet activity affecting hundreds of thousands of routers worldwide and has been used to provide proxy infrastructure for cybercriminal operations, including digital fraud. Security reporting has linked SocksEscort to AVrecon, a SOHO-focused malware botnet, through overlapping command-and-control infrastructure, indicating that infected routers were enrolled and then resold or abused as proxy nodes.
Operationally, SocksEscort turns compromised routers into intermediary systems that relay traffic through victims’ residential or business internet connections, helping operators and customers conceal origin and blend malicious activity with legitimate network space. This places it in the broader category of covert proxy networks built from neglected internet-facing devices. The service has been discussed alongside other router-focused malware and proxy ecosystems that exploit unsupported or poorly maintained edge infrastructure.
SocksEscort primarily targets network edge devices rather than traditional endpoints. Available reporting supports its role as a malware-enabled proxy network and monetization layer, but does not provide high-confidence detail on its exact initial infection vectors within this dataset. Law enforcement and private-sector disruption efforts have significantly degraded the service at times by targeting supporting infrastructure, sharply reducing available proxy inventory.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
The proxy control servers appeared to still be online ... The smoking gun was in Lumen's remediation ... black hole-ing the IP addresses belonging to the stage 2 C2 infrastructure for AVrecon.
A majority of China-linked threat actors are using compromised routers and IoT devices worldwide, turning this gear into proxy networks to carry out further intrusions, steal sensitive data, and disrupt victim organizations’ operations.
SocksEscort — one of the oldest malware proxy services we track ... identify SocksEscort as the malware proxy service tied to this particular botnet based on the C2 infrastructure.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.