Law enforcement agencies in the US and Europe have disrupted SocksEscort, a malicious proxy service that facilitated criminal activities.
Storm-2561 spreads fake VPN installers via SEO poisoning and GitHub downloads, stealing enterprise VPN credentials with Hyrax malware.
SocksEscort sold proxy services on the open web, but was actually routing traffic through compromised routers and internet-connected devices.