Three Russian nationals — 37-year-old Alexey Viktorovich Chertkov, 41-year-old Kirill Vladimirovich Morozov and 36-year-old Aleksandr Aleksandrovich Shishkin — were charged with conspiracy and damage to protected computers for their role in running botnet services offered through Anyproxy and 5socks. The notice coincides with an alert released by the FBI on Wednesday warning people that end-of-life routers that are no longer supported by the companies that made them were the primary target of the administrators behind Anyproxy and 5socks. A malware campaign allowed the men to reconfigure the routers and offer them for sale as proxy servers through the Anyproxy and 5socks sites. The Justice Department said the website domains were managed by a company based in Virginia and that the four men allegedly earned about $46 million through the infected routers over a 20-year stretch. For years, critical vulnerabilities in routers have been abused by hackers who use them as cover for subsequent attacks or add them to powerful botnets that disrupt websites with bogus traffic. The Justice Department said it seized the domain names Anyproxy.net and 5socks.net — with both sites now featuring a law enforcement takedown banner. The investigation was run out of the Oklahoma City FBI office after multiple businesses and homes in the state were found to have routers infected with the malware used in the campaign. U.S. officials in recent months have raised alarms about TP-Link routers specifically because they are repeatedly being exploited by Chinese hackers who have used them to breach telecommunications giants. Two powerful botnets have been dismantled by law enforcement agencies and the alleged administrators now face criminal charges, U.S. prosecutors said Friday. Lumen found that the group is not using zero-day vulnerabilities and typically exploits an array of bugs to take over devices — specifically targeting end-of-life devices with issues dating back years. U.S. officials worked with law enforcement in Thailand and the Netherlands on the operation as well as Lumen Technologies’ Black Lotus Labs. The 5socks.net website offered more than 7,000 proxies for sale and allowed users to pay monthly fees of up to $110 for access. Compromised routers continue to be a key avenue for Chinese hacking campaigns targeting U.S. critical infrastructure. The law enforcement splash page on the 5socks and Anyproxy sites.
This Cyber News was published on therecord.media. Publication date: Fri, 09 May 2025 19:10:07 +0000