InfoSecBulletin Cybersecurity for mankind
The FBI has observed a type of malware named AVrecon, which was used to target many network devices around the world. The malware has a flexible design, allowing new attack tools to be added when new weaknesses are found.
This increases the number of devices it can infect. The FBI found about 1,200 targeted device types from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
Singapore major data centres, cloud providers could incur fine up to $1m
IBM-managed instance breach exposes personal data of 70,000 in Singapore
Alibaba Reportedly Bans Claude Code for Suspected AI Tool Backdoor
CISA KEV Adds SharePoint RCE CVE-2026-45659 After Active Exploits
AVrecon can change infected devices into proxy nodes. It can also update its saved settings, connect to a server controlled by an attacker, and download and run different programs on the device.
Once a router gets infected, the malware sends signals to its command and control server every 60 seconds using a PING/PONG method. When the server has instructions, it stops the loop and tells the infected router to open a traffic tunnel to a SocksEscort relay server.
The Persistence Problem
The way AVrecon stays on some devices makes fixing them hard. Attackers use the device’s firmware update feature to put in a special firmware that has AVrecon. This stops the device from getting future updates or changes.
The FBI notes these devices are essentially permanently infected — a factory reset cannot help if the reset itself has been disabled, and an end-of-life device has no manufacturer patches to address the underlying vulnerability regardless.
What SocksEscort Built and Sold
SocksEscort ran an illegal service that let customers hide their internet activity using hacked home and small-office routers in 163 countries, including the United States. They used a tunneling method called SOCKS, which is a real networking standard that sends traffic through another computer. In this illegal way, it made the attacker look like they were using the victim’s home IP address instead of a place that could be blocked or traced.
FBI thinks SocksEscort has taken and sold access to about 369,000 devices since 2020. The malware that made this happen is called AVrecon. It was made using the C programming language and is meant to attack devices that use MIPS and ARM processors, which are common in consumer routers.
What the Proxy Network Enabled
The FBI and partners saw that SocksEscort used its system for ad fraud, trying to exploit website weaknesses, password attacks, digital market fraud, bank fraud, and romance fraud, among other bad acts. By using home IP addresses for attacks, SocksEscort customers greatly improved their chances of getting past corporate security checks and lists that block traffic from well-known commercial or cloud service providers.
Remediation for Network Defenders
FBI says to update the firmware on all home routers and IoT devices now. Many devices do not update by themselves and need you to do it through their settings. If a device is End-of-Life and doesn’t get security updates anymore, you should replace it completely.
Remote admin features should be turned off or limited with firewall rules, and all default passwords need to be changed.
Network defenders should monitor for traffic to the C2 domains and IP addresses published in the advisory and watch for the malware filenames “x” (loader) and “dnssmasq” (malware) on network-connected devices.
