InfoSecBulletin Cybersecurity for mankind
The FBI has observed a type of malware named AVrecon, which was used to target many network devices around the world. The malware has a flexible design, allowing new attack tools to be added when new weaknesses are found.
This increases the number of devices it can infect. The FBI found about 1,200 targeted device types from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.
New Windows Defender ‘RoguePlanet’ zero-day grants SYSTEM privileges
Microsoft June Patches 200 Vulnerabilities including 3 zero days
World’s first wind power underwater data center is now live
VMware Fixed Multiple Flaws Allow Attackers to Inject Malicious Scripts
CVE-2026-50751
Check Point VPN 0-day Flaw Exploited in the Wild
AI-designed First ‘universal vaccine’ tested in humans
China Unveils First Prefabricated Data Center Base, Reducing Construction Time by 70%
Hacker now exploits recently patched SolarWinds Serv-U flaw
Cisco SD-WAN Flaw Exploited and Trend Micro Flaws Allows to Security Bypass
Ransomware Crisis Deepens: 4,089 Victims Hit Across 121 Countries in 2026
AVrecon can change infected devices into proxy nodes. It can also update its saved settings, connect to a server controlled by an attacker, and download and run different programs on the device.
Once a router gets infected, the malware sends signals to its command and control server every 60 seconds using a PING/PONG method. When the server has instructions, it stops the loop and tells the infected router to open a traffic tunnel to a SocksEscort relay server.
The Persistence Problem
The way AVrecon stays on some devices makes fixing them hard. Attackers use the device’s firmware update feature to put in a special firmware that has AVrecon. This stops the device from getting future updates or changes.
The FBI notes these devices are essentially permanently infected — a factory reset cannot help if the reset itself has been disabled, and an end-of-life device has no manufacturer patches to address the underlying vulnerability regardless.
What SocksEscort Built and Sold
SocksEscort ran an illegal service that let customers hide their internet activity using hacked home and small-office routers in 163 countries, including the United States. They used a tunneling method called SOCKS, which is a real networking standard that sends traffic through another computer. In this illegal way, it made the attacker look like they were using the victim’s home IP address instead of a place that could be blocked or traced.
FBI thinks SocksEscort has taken and sold access to about 369,000 devices since 2020. The malware that made this happen is called AVrecon. It was made using the C programming language and is meant to attack devices that use MIPS and ARM processors, which are common in consumer routers.
What the Proxy Network Enabled
The FBI and partners saw that SocksEscort used its system for ad fraud, trying to exploit website weaknesses, password attacks, digital market fraud, bank fraud, and romance fraud, among other bad acts. By using home IP addresses for attacks, SocksEscort customers greatly improved their chances of getting past corporate security checks and lists that block traffic from well-known commercial or cloud service providers.
Remediation for Network Defenders
FBI says to update the firmware on all home routers and IoT devices now. Many devices do not update by themselves and need you to do it through their settings. If a device is End-of-Life and doesn’t get security updates anymore, you should replace it completely.
Remote admin features should be turned off or limited with firewall rules, and all default passwords need to be changed.
Network defenders should monitor for traffic to the C2 domains and IP addresses published in the advisory and watch for the malware filenames “x” (loader) and “dnssmasq” (malware) on network-connected devices.
