European and U.S. authorities have announced the dismantling of a major malicious proxy operation tied to malware-infected home and small-business routers, freezing $3.5 million in cryptocurrency and seizing infrastructure used to support fraud.
Servers used for cybercrime around the world taken down
️ Authorities from eight countries targeted a website allegedly offering IP proxy services for cybercriminals in 102 countries.
According to Europol, law enforcement seized 34 domains and 23 servers across seven countries, while U.S. authorities froze $3.5 million in crypto linked to the case. Europol also said that a payment platform linked to the service is estimated to have received more than $5.7 million (€5 million) in cryptocurrency.
The investigation, which began in June 2025 under Europol’s Joint Cyberaction Task Force, uncovered a botnet of infected devices, mainly residential routers, exploited to facilitate criminal activities including ransomware, DDoS attacks, and the distribution of child sexual abuse material.
Federal prosecutors cited multiple alleged victim losses, including a New York crypto exchange customer reportedly defrauded of $1 million in digital assets, a Pennsylvania manufacturer that allegedly lost $700,000, and current and former military service members allegedly defrauded of $100,000.
“By dismantling this infrastructure, law enforcement has disrupted a service that enabled cybercrime on a global scale,” Europol Executive Director Catherine De Bolle said in a statement, adding that, “Operations like this show that when investigators connect the dots internationally, the infrastructure behind cybercrime can be exposed and shut down.”
