Dutch Authorities Dismantle 17‑Million‑Device Botnet Linked to ASOCKS Residential Proxy Service
What Happened – Dutch police, together with the National Cyber Security Centre (NCSC), seized more than 200 servers and took offline a botnet that had compromised at least 17 million consumer devices (PCs, tablets, smartphones). The infrastructure was tied to the residential‑proxy provider ASOCKS, which was being abused for DDoS, phishing, and large‑scale web‑scraping campaigns.
Why It Matters for TPRM –
- Residential‑proxy services can become a hidden supply‑chain risk, allowing attackers to mask malicious traffic behind legitimate‑looking IPs.
- Compromised end‑user devices may be leveraged to launch attacks against your organization’s external‑facing assets.
- The scale of the botnet demonstrates how weak device hygiene can translate into a global threat vector that impacts third‑party risk assessments.
Who Is Affected – All sectors that rely on internet‑exposed services, especially Finance Services, Retail/E‑Commerce, Technology SaaS, and any organization that outsources traffic routing through third‑party proxy or CDN providers.
Recommended Actions –
- Review any contracts or usage of residential‑proxy or anonymisation services.
- Enforce strict endpoint hardening (patch management, MFA, strong passwords) for all employee‑owned devices.
- Deploy outbound traffic monitoring to detect unusual proxy traffic patterns.
- Incorporate proxy‑service vetting into your third‑party risk questionnaires.
Technical Notes – The botnet was built by infecting consumer devices with malware that routed traffic through ASOCKS’s proxy network. No specific CVE was cited; the infection vector relied on outdated software, weak passwords, and malicious Android apps. Data types exfiltrated were not disclosed, but the infrastructure supported DDoS, phishing, and large‑scale web‑scraping. Source: https://securityaffairs.com/192890/malware/botnet-of-17-million-devices-dismantled-in-the-netherlands.html