Netherlands seizes servers in 17M-device botnet takedown

Dutch police and the National Cyber Security Center dismantled a botnet that had enlisted at least 17 million infected devices and removed more than 200 servers in the Netherlands that acted as the network’s backend for a residential proxy service.

Authorities identified a hosting provider that supplied parts of the infrastructure and seized a subset of the servers. After the seizures, the provider took portions of the network offline once it learned the systems were being used for criminal purposes.

Investigators say the botnet operated through a control layer on the seized servers to manage compromised computers, tablets, smartphones and internet-connected devices. Those devices were then available to route traffic for customers of the proxy service.

Security teams linked the infected devices to a proxy ecosystem that includes mobile proxy software and residential proxy offerings. In April 2024, a campaign tracked as PROXYLIB involved infected Android devices running proxyware developed by LumiApps and connections to the proxy service known as Asocks.

Asocks advertises corporate, residential and mobile proxies with monthly subscriptions roughly between $5 and $15 and discounts for bulk purchases of 10 to 100 proxies.

The National Cyber Security Center explained, “Devices can become part of a botnet when they are accessible to malicious actors. After gaining access, attackers can install malware that allows the device to be controlled remotely. This enables the device to become part of a network used for cybercriminal activities.”

Authorities urged users and organizations to reduce exposure by keeping operating systems and firmware up to date, monitoring edge devices such as routers, using strong passwords and two-factor authentication, installing apps only from trusted sources, changing default device credentials, and securing Wi‑Fi with WPA2 or WPA3 encryption.

No information on arrests or criminal charges has been released. Officials said the server seizures removed a key part of the botnet’s control infrastructure, and security teams are reviewing indicators of compromise and network traffic patterns to help identify and remediate infected systems.