SocksEscort Takedown: AVrecon Botnet Analysis and Banking Fraud Impact

Executive Summary

Why This Matters to Banks

SocksEscort was not a generic cybercrime tool — it was specifically used for financial fraud. Court documents and the FBI FLASH advisory (20260312-001) confirm:

How It Defeats Bank Fraud Controls

Residential proxy botnets make criminal traffic indistinguishable from legitimate customer activity at the network layer:

Technical Analysis

The Malware: AVrecon

SocksEscort's proxy network was powered by AVrecon, a Linux-based Remote Access Trojan (RAT) written in C that targets small-office/home-office (SOHO) routers and IoT devices.

Top 20 Targeted Device Models

Source: FBI FLASH 20260312-001

Persistence Mechanism

AVrecon employs two persistence strategies:

1. Firmware persistence — Flashes custom firmware containing AVrecon, hardcoded to execute on startup. The modified firmware disables update and flashing features, making the infection permanent.
2. Non-persistent deployment — Runs in memory without persistence. A power cycle clears the infection. However, C2 servers have been observed re-infecting devices using the same original vulnerability.

Command and Control Architecture

AVrecon uses a tiered C2 architecture:

When a C2 server has tasking, it interrupts the heartbeat loop and directs the router to open a SOCKS5 tunnel to a relay server. SocksEscort customers then route their traffic through the infected residential router.

C2 Communication Protocol

GET /lumi/track.php?pet=maral&age=<version>&up=<uptime> HTTP/1.1
Host: <c2_domain>
X-Proto-Cookies: <encrypted>
X-Proto-UAgent: <encrypted>
X-Proto-Version: <encrypted>
X-Proto-System: <encrypted>
X-Proto-Storage: <encrypted>
X-Proto-Core: <encrypted>
X-Proto-Jid: <encrypted device ID>
Connection: close

Custom X-Proto-* headers carry encrypted device reconnaissance data. The heartbeat protocol exchanges literal PING and PONG strings over port 8000.

Malware Artifacts

From our analysis of two AVrecon samples obtained from MalwareBazaar (verified against FBI FLASH and Black Lotus Labs hashes):

Infrastructure Analysis

C2 Hosting Providers

We enriched all 24 C2 IP addresses from the FBI FLASH against current ASN and geolocation data:

Passive DNS History

Using AlienVault OTX passive DNS, we reconstructed C2 domain resolution history not included in any public report:

zerophone.cc (registered January 2016 — oldest known C2 domain):

Multiple seized domains now resolve to Shadowserver Foundation sinkhole IPs — confirming active monitoring of infected devices still attempting to beacon.

Domain Registration Patterns

• r0ck.online and evrc.space were registered on the same day (August 31, 2023) — seven weeks after the 2023 C2 disruption. Both initially resolved to 127.0.0.1 (localhost), indicating pre-staged reserve domains.
• Operators used multiple registrars (Eranet, GoDaddy, PublicDomainRegistry) to avoid single-point takedown.
• 20 of 23 FBI FLASH domains use the .cc TLD. Non-.cc domains appeared only after the 2023 disruption — TLD diversification as an operational security response.

What the Takedown Did — and Didn't — Accomplish

Detection Guidance for Financial Institutions

Network-Based Detection

Port-Based Detection

Fraud Engine Adjustments

Note: ASNs such as AS29066 (velia.net) and AS9009 (M247) are large, legitimate providers abused among many legitimate tenants. Flag specific IP ranges rather than blanket-blocking.

Residential Proxy Detection

Endpoint and Network Security

For branch networks, ATM connectivity, and corporate infrastructure:

• Audit network devices against the FBI FLASH targeted device list. Prioritize End-of-Life devices.
• Monitor SOHO routers for outbound connections to C2 IPs and domains on ports 8000, 5178, and 8080.
• Implement DNS sinkholing for the 23 confirmed C2 domains on internal resolvers.
• Ensure firmware is current on all internet-facing network equipment — many SOHO devices do not auto-update.

For remote workforce:

• Employees connecting via VPN through home routers among the 1,200 targeted models may unknowingly route traffic through compromised devices.
• Provide guidance on router firmware updates and password changes for identified device models.

Indicators of Compromise

File Hashes — Loader (x)

File Hashes — Main RAT (dnssmasq)

References

1. FBI FLASH 20260312-001 — AVrecon Malware-Infected Routers Exploited as Residential Proxies by SocksEscort (TLP:CLEAR)
2. Europol — Europol and International Partners Disrupt SocksEscort Proxy Service
3. IRS Criminal Investigation — Authorities Dismantle Global Malicious Proxy Service