PANews reported on March 13 that, according to Decrypt, Europol, in conjunction with the US Department of Justice and other agencies, announced the dismantling of a malicious proxy service network called "SocksEscort" and the freezing of $3.5 million in cryptocurrency related to the case. The network allegedly compromised over 369,000 routers and IoT devices in 163 countries worldwide, providing users with over 35,000 proxies in recent years.

Europol stated that the operation resulted in the seizure of 34 domain names and 23 servers across seven countries. The payment platforms associated with the service are estimated to have received over $5.7 million in cryptocurrency. The investigation, which began in June 2025, found that the infected devices were primarily used to facilitate ransomware, DDoS attacks, and other criminal activities. The U.S. Department of Justice alleges that criminals used proxy services to conceal their locations and carry out fraud such as bank and cryptocurrency account takeovers, citing multiple cases of victim losses, including one where a customer of a New York cryptocurrency exchange was defrauded of $1 million.