International Task Force Led by the USDOJ Thwarts Global Cybercrime Syndicate

Written by Crime Beat Correspondent Kirsten Kimbal

A sweeping international law enforcement operation led by the U.S. Department of Justice has dismantled a large-scale cybercriminal network accused of exploiting thousands of internet-connected devices worldwide to facilitate fraud, officials announced this week.

The operation targeted a service known as SocksEscort, described in court documents as a “residential proxy network” that infected home and small business routers with malware, allowing cybercriminals to reroute internet traffic through compromised devices. U.S. Attorney Eric Grant said authorities executed seizure warrants against dozens of U.S.-registered domains linked to the operation.

According to investigators, SocksEscort enabled users to mask their true locations by routing online activity through infected routers, making it significantly more difficult for law enforcement and financial institutions to detect fraudulent behavior. Since mid-2020, the network allegedly offered access to hundreds of thousands of IP addresses worldwide. As recently as February 2026, approximately 8,000 compromised routers were actively listed for sale, including roughly 2,500 located in the United States.

Authorities say the service was used to carry out a wide range of financial crimes, including bank account takeovers, cryptocurrency theft, and fraudulent unemployment insurance claims. Prosecutors estimate that victims lost millions of dollars as a result.

Among the documented cases, a New York-based cryptocurrency account holder was defrauded of approximately $1 million, while a Pennsylvania manufacturing company lost $700,000. Investigators also identified current and former U.S. service members who were collectively defrauded of about $100,000 through compromised military-linked credit accounts.

The takedown was coordinated across multiple countries, with law enforcement agencies in Austria, France, and the Netherlands seizing servers connected to the network. The operation involved extensive international cooperation, with support from Europol, Eurojust, and authorities across Europe.

In the United States, the investigation is being led by the FBI’s Sacramento Field Office, alongside the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service and IRS Criminal Investigation. Additional support came from several Justice Department divisions and federal agencies focused on cybercrime and financial enforcement.

Officials said the disruption of SocksEscort represents a significant step in combating increasingly sophisticated cyber-enabled fraud schemes that rely on anonymization technologies to evade detection. The investigation remains ongoing, and authorities have not yet announced individual criminal charges tied to the network.

EDITOR’S NOTE: Dedicated journalism requires not only real effort and real dedication, but real money. The Florida Sun Journal will NEVER be influenced by the deep pockets of savvy investors who want to use their wealth to, in any way, influence or block the rightful dissemination of information to the public in accordance with their own personal ideologies. For that reason, we rely on the help of our everyday readers in assisting us to keep the lines of honest and factual information running fluidly through our pages, videos, and podcasts. If you have the means and the desire to help our mission of restoring integrity and neutrality to journalism, please consider becoming a subscriber to our publication and receive a lot of really cool perks in the process. Visit www.patreon.com/FloridaSunJournal for more information or to subscribe.