A criminal group built a service called SocksEscort. They used malware called AVrecon to break into routers at homes and small businesses, then sold access to those compromised connections to other criminals. The criminals who bought access could route their illegal activity through your IP address, making it look like it came from your office network.

SocksEscort customers used those stolen connections to commit:

To any security system watching, that activity appeared to originate from ordinary home and business internet addresses.

The FBI, Europol, and law enforcement partners in France, the Netherlands, and Austria coordinated the takedown. Law enforcement seized 34 domains and shut down 23 servers across seven countries. The SocksEscort service has been disrupted. The malware may still be present on infected devices.

AVrecon does not need you to click anything. It spreads by scanning the internet for routers with known, unpatched vulnerabilities. The attack methods include Remote Code Execution (RCE), command injection, and weaknesses in SOAP interfaces found in many small business router management panels.

Once it finds a vulnerable router, it installs itself silently. Your internet continues to work normally. Most people never notice anything is wrong.

AVrecon is written to be lightweight and hard to detect. Routers do not run antivirus software. There is no endpoint agent watching for it. That is exactly why attackers went after them.

The FBI identified 18 router models that appeared most frequently in the confirmed infection data. Check the label on the bottom of your router and compare it against this list.

This is the part I want to make sure is clear, because it is the part most people get wrong.

On some infected routers, the attackers used the device's own built-in firmware update feature to flash a custom firmware image. That image contains a hardcoded copy of AVrecon. It also disables the device's ability to accept future updates or be reflashed. Those routers are, for practical purposes, permanently infected. A factory reset does nothing. The malware survives it.

If your router model is on the list above, treat it as compromised and plan to replace it.

If your router is not on the list but is several years old, check the manufacturer's website and look up the end-of-life date for your specific model. End-of-life devices no longer receive security patches. That is exactly what made these routers attractive targets. A router that does not get updates is a router waiting to be compromised the same way.

For any router you plan to keep in service, do these four things:

1. 1 Log into the admin panel and apply any available firmware update.
2. 2 Disable remote management if you do not actively use it. This closes one of the most common entry points.
3. 3 Change the default admin credentials if you have not already.
4. 4 Watch for warning signs: unusual spikes in data usage, slower performance with no clear cause, or devices on your network you do not recognize.

If your router is on the list or is end-of-life, those steps are not a permanent fix. Replacement is the answer.

I see this pattern constantly with small and mid-sized businesses in the Dayton area. Security attention goes toward the obvious stuff: the workstations, the servers, the Microsoft 365 accounts. The router sits in the corner and nobody thinks about it because the internet keeps working.

That is exactly the blind spot this operation exploited. Criminals specifically targeted SOHO routers because they know those devices go years without updates, they have no endpoint protection running on them, and most business owners never check them.

A compromised router means criminal traffic is moving through your business IP address. Depending on what that traffic is used for, it can create legal exposure, trigger fraud flags with your bank or payment processor, or get your IP address blacklisted by services your business depends on every day.

It also means an attacker has persistent remote access to the device that sits between your business and the internet. That is not a minor issue.