Dutch authorities dismantled a massive botnet that controlled more than 17 million infected devices in one of the largest cybercrime disruptions in recent years.

The operation involved the Dutch National Police and the National Cyber Security Centre (NCSC). Investigators identified around 200 servers that managed the network’s infrastructure. Officials said the servers operated from hosting facilities inside the Netherlands.

The investigation started after a cybersecurity researcher alerted the NCSC about suspicious activity tied to a sprawling proxy network. Authorities traced the infrastructure and launched a joint probe with law enforcement agencies.

Millions of infected devices

Investigators found that the botnet controlled at least 17 million compromised devices. The infected hardware included computers, smartphones, tablets, routers, and smart home products connected to the internet.

Police later seized several servers connected to the network. Hosting providers also disabled parts of the infrastructure after authorities confirmed the systems supported criminal activity.

Officials said cybercriminals used the botnet to conduct attacks and conceal online operations. According to Dutch authorities, the network supported phishing campaigns, spam distribution, and distributed denial-of-service attacks targeting online services.

The Dutch newspaper NL Times linked the network to ASOCKS, a Russia-based residential proxy provider. Residential proxy services route internet traffic through third-party consumer devices. Users often rely on these services to disguise their location or identity online.

Residential proxies under scrutiny

Cybersecurity experts have increasingly warned about the misuse of residential proxy networks. These systems can blend malicious traffic with legitimate internet activity, making attacks significantly harder to detect.

In a separate advisory, the NCSC warned that cybercriminals use residential proxies to bypass geographic restrictions and maintain anonymity online. The agency said these services can also mask malicious traffic as ordinary local internet activity.

“Dutch organizations can be attacked with Dutch proxies that resemble regular traffic,” the agency said. Authorities added that this overlap complicates cybercrime detection and mitigation efforts for security teams.

Law enforcement agencies worldwide have raised concerns about proxy services tied to botnets. Criminal groups often use them to operate phishing networks, scrape websites, and manage command-and-control infrastructure for cyberattacks.

Security risks keep growing

Authorities urged consumers and businesses to strengthen device security as internet-connected hardware continues expanding across homes and workplaces. Officials warned that insecure devices remain easy targets for malware infections and remote takeovers.

The NCSC said poorly secured devices often become entry points for malicious software. Once attackers gain access, they can remotely control infected hardware without owners noticing suspicious behavior.

Officials encouraged users to install software updates quickly and replace default passwords on routers and smart devices. They also recommended enabling two-factor authentication and monitoring devices connected to home networks regularly.

The takedown highlights growing concerns around insecure Internet of Things devices. Millions of smart gadgets now connect to global networks with limited built-in protections, creating new opportunities for cybercriminals.

Cybersecurity agencies have repeatedly warned that unpatched devices can quickly become part of large-scale botnets capable of disrupting online services worldwide. Dutch authorities did not identify suspects connected to the operation, and the investigation remains ongoing.

Recommended Articles