Crackdown on Cybercrime
In a significant crackdown on cybercrime, authorities in Europe and the United States have successfully dismantled a vast proxy service linked to malware infections in home and small-business routers. This operation, known as Operation Lightning, executed on March 11, has resulted in the seizure of infrastructure driving fraud activities and the freezing of $3.5 million in cryptocurrency.
Details of the Operation
Europol has reported that this campaign targeted the proxy service named SocksEscort, which has reportedly compromised more than 369,000 routers and Internet of Things (IoT) devices across 163 nations, providing access to over 35,000 proxies over the years. As part of this operation, law enforcement agencies seized 34 domain names and 23 servers spread across seven countries. In addition, a payment platform associated with SocksEscort is believed to have handled transactions exceeding $5.7 million (€5 million) in cryptocurrency.
Investigation Insights
Beginning in June 2025, the investigation was spearheaded by Europol’s Joint Cyberaction Task Force, uncovering a botnet made up mainly of residential routers. These compromised devices were allegedly used to conduct various criminal activities, including:
- Launching ransomware attacks
- Executing DDoS assaults
- Distributing child sexual abuse content
Impact on Victims
In a related update, authorities from the U.S. Attorney’s Office for the Eastern District of California disclosed that as of February 2026, the SocksEscort application had identified approximately 8,000 infected routers, with about 2,500 located within the United States. U.S. law enforcement officials asserted that these proxies were exploited by criminals to obscure their location when perpetrating fraud, including:
- Taking over bank and cryptocurrency accounts
- Filing fraudulent unemployment claims
Federal prosecutors highlighted significant impacts on victims, including:
- A customer from a New York cryptocurrency exchange who lost $1 million in digital assets
- A Pennsylvania business that reported a loss of $700,000
- Service members who were defrauded out of $100,000
Statements from Authorities
Catherine De Bolle, Europol’s Executive Director, emphasized the importance of such operations, stating, “By dismantling this infrastructure, law enforcement has disrupted a service that enabled cybercrime on a global scale. Operations like this demonstrate that through international collaboration, we can uncover and dismantle the networks that facilitate cybercriminal activities.”
