Dutch Police Take Down 17‑Million‑Device Botnet Leveraging Residential Proxies
What Happened – The Dutch National Police, together with the National Cyber Security Center (NCSC), seized 200 servers in the Netherlands and disabled a botnet estimated to control 17 million compromised devices (PCs, smartphones, IoT gear, routers). The botnet underpinned the commercial residential‑proxy service “Asocks,” which is used for DDoS, credential stuffing, click‑fraud, SMS pumping and malware distribution.
Why It Matters for TPRM –
- A botnet of this size can turn any third‑party device (customer, employee, supplier) into a launchpad for attacks against your organization.
- Residential proxies mask malicious traffic as legitimate user traffic, making detection and blocking far more difficult for downstream vendors.
- The incident highlights the risk of “proxyware” being bundled with legitimate software, exposing supply‑chain partners to inadvertent compromise.
Who Is Affected – Technology & SaaS providers, cloud hosting platforms, IoT manufacturers, mobile app developers, and any organization that relies on third‑party APIs or services that may route traffic through residential proxies.
Recommended Actions –
- Review contracts and security questionnaires for any vendors that provide or consume residential proxy services.
- Verify that your organization’s traffic monitoring can differentiate residential‑proxy IPs from genuine end‑user traffic.
- Conduct endpoint hygiene checks to ensure devices are not unintentionally running proxyware or compromised SDKs (e.g., LumiApps/PROXYLIB).
- Update incident‑response playbooks to include botnet‑related abuse scenarios.
Technical Notes – The botnet’s command‑and‑control infrastructure was hosted on 200 physical servers in the Netherlands. Infected devices were recruited via a malicious SDK component (PROXYLIB) embedded in the LumiApps development kit, which silently installed proxy functionality. The botnet facilitated DDoS, credential‑stuffing, click‑fraud, SMS‑pumping and malware distribution. Source: Help Net Security