Law enforcement dismantled SocksEscort, a criminal proxy-as-a-service network that infected approximately 369,000 SOHO and residential routers across 163 countries using AVrecon malware. Attackers flashed custom firmware onto compromised devices, disabling update mechanisms and reselling hijacked bandwidth as anonymous proxy exit nodes, rendering standard patching ineffective on already-infected devices; affected routers require factory reset and verified firmware reflash to recover. Organizations and employees using affected router models from Cisco, D-Link, Hikvision, MikroTik, NETGEAR, TP-Link, and Zyxel face persistent compromise risk; infected devices may have routed attacker traffic through corporate or home networks undetected for multiple years.