InfoSecBulletin Cybersecurity for mankind
The FBI has observed a type of malware named AVrecon, which was used to target many network devices around the world. The malware has a flexible design, allowing new attack tools to be added when new weaknesses are found.
This increases the number of devices it can infect. The FBI found about 1,200 targeted device types from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
AVrecon can change infected devices into proxy nodes. It can also update its saved settings, connect to a server controlled by an attacker, and download and run different programs on the device.
Once a router gets infected, the malware sends signals to its command and control server every 60 seconds using a PING/PONG method. When the server has instructions, it stops the loop and tells the infected router to open a traffic tunnel to a SocksEscort relay server.
The Persistence Problem
The way AVrecon stays on some devices makes fixing them hard. Attackers use the device’s firmware update feature to put in a special firmware that has AVrecon. This stops the device from getting future updates or changes.
The FBI notes these devices are essentially permanently infected — a factory reset cannot help if the reset itself has been disabled, and an end-of-life device has no manufacturer patches to address the underlying vulnerability regardless.
What SocksEscort Built and Sold
SocksEscort ran an illegal service that let customers hide their internet activity using hacked home and small-office routers in 163 countries, including the United States. They used a tunneling method called SOCKS, which is a real networking standard that sends traffic through another computer. In this illegal way, it made the attacker look like they were using the victim’s home IP address instead of a place that could be blocked or traced.
FBI thinks SocksEscort has taken and sold access to about 369,000 devices since 2020. The malware that made this happen is called AVrecon. It was made using the C programming language and is meant to attack devices that use MIPS and ARM processors, which are common in consumer routers.
What the Proxy Network Enabled
The FBI and partners saw that SocksEscort used its system for ad fraud, trying to exploit website weaknesses, password attacks, digital market fraud, bank fraud, and romance fraud, among other bad acts. By using home IP addresses for attacks, SocksEscort customers greatly improved their chances of getting past corporate security checks and lists that block traffic from well-known commercial or cloud service providers.
Remediation for Network Defenders
FBI says to update the firmware on all home routers and IoT devices now. Many devices do not update by themselves and need you to do it through their settings. If a device is End-of-Life and doesn’t get security updates anymore, you should replace it completely.
Remote admin features should be turned off or limited with firewall rules, and all default passwords need to be changed.
Network defenders should monitor for traffic to the C2 domains and IP addresses published in the advisory and watch for the malware filenames “x” (loader) and “dnssmasq” (malware) on network-connected devices.
