A massive botnet consisting of roughly 17 million compromised consumer devices was controlled via approximately 200 servers physically hosted in the Netherlands. The Dutch Police and NCSC acted on a tip from a security researcher, conducting a forensic investigation that led to the seizure of these servers from a local hosting provider. The botnet was used to operate a residential proxy service, likely the Asocks network, monetizing hijacked devices as exit nodes. Following the seizure, the hosting provider permanently shut down the botnet infrastructure. The NCSC provided specific mitigation guidance to prevent device compromise and botnet integration, including patching, enforcing MFA, replacing default passwords, and securing wireless networks. This operation aligns with other recent international takedowns of proxy and botnet networks targeting SOHO routers and consumer devices.

The botnet compromised approximately 17 million devices globally, including computers, smartphones, and tablets, enabling cybercriminals to leverage these devices for illicit activities such as proxy services. The large scale of the botnet posed significant risks for abuse in cyberattacks, anonymization of malicious traffic, and potential further exploitation of compromised devices. The seizure of the 200 servers hosting the botnet infrastructure disrupted the criminal operation and removed a major threat actor's capability. The hosting provider's permanent shutdown of the infrastructure further mitigated ongoing risks. No direct information about exploitation of specific vulnerabilities or data breaches was provided.

The Dutch NCSC recommends users and network administrators to promptly patch operating systems, routers, and applications to reduce compromise risk. Enforcing multi-factor authentication and replacing default hardware passwords are critical to prevent unauthorized access. Securing Wi-Fi networks with WPA2 or WPA3 encryption is advised to protect network traffic. Maintaining full visibility of all devices connected to the network perimeter helps detect anomalous activity. Users should only install software from trusted sources and use comprehensive antivirus or security solutions. Since the botnet infrastructure has been seized and taken offline, these measures serve to prevent future device compromise and botnet formation.