International police have dismantled a major cybercrime network that secretly used thousands of home internet routers to hide illegal online activities. Authorities say more than 700 people in Austria were among the victims whose devices were unknowingly exploited, according to ORF News.
The operation, called “Lightning,” targeted a malicious proxy service known as SocksEscort. Cybercriminals had taken control of poorly secured or outdated home routers and internet‑connected devices, turning them into a network that allowed criminals to mask their identities online. Using these hijacked connections, offenders could launch cyberattacks, commit fraud, and distribute illegal material while appearing to operate from ordinary households around the world.
The international crackdown was coordinated by Europol and carried out on March 11, 2026, with law enforcement agencies from Austria, France, the Netherlands, and the United States working together. Investigators seized the service’s technical infrastructure, shut down servers, and froze about $3.5 million in cryptocurrency believed to be linked to the network’s profits.
According to Europol, the SocksEscort network had infected more than 369,000 routers and internet‑connected devices across 163 countries at its peak. Even in February 2026, authorities estimate that around 8,000 devices were still compromised worldwide, including roughly 2,500 in the United States.
In Austria, officials say the damage reached hundreds of households and businesses. The Bundeskriminalamt (Federal Criminal Police Office) reported that over 700 people had their routers unknowingly turned into tools for criminal activity. Many victims had no idea their devices were being used in illegal operations taking place across the internet.
Investigators say the case highlights how vulnerable everyday technology can be when security updates are ignored or devices become outdated. Home routers, often left unchanged for years, can become easy targets for hackers looking to build anonymous networks.
Authorities say the takedown marks a major step in disrupting the cybercriminal operation, but the investigation is still ongoing. More arrests and the seizure of additional assets are possible in the coming weeks as investigators continue to track those responsible.
Officials are also urging the public to update router software, change default passwords, and regularly check device security to prevent similar attacks in the future.
