The United States, along with the United Kingdom, Germany and the Netherlands, have shut down Russia’s RSocks botnet, a network of infected devices used to organize DDoS attacks and spam. It worked under the guise of a proxy server provider: this botnet traded on the IP addresses of hacked devices, while legitimate proxy services sold customers access to IP addresses leased from ISPs.

RSocks was discovered in 2017: by then, hackers had already hacked more than 325,000 devices. A cybercriminal wishing to use the RSocks platform can hire a pool of proxy servers to route malicious traffic through compromised victim devices. The cost of accessing the RSocks proxy pool ranged from $30 per day for access to 2,000 proxies to $200 per day for access to 90,000 proxies.

According to the US Department of Justice, victims of the botnet were several large American public and private organizations, including a university, a hotel, a television studio and an electronics manufacturer.