Dutch authorities have announced the takedown of a massive botnet that reportedly controlled at least 17 million infected devices, including computers, tablets, smartphones, and Internet of Things devices.
According to the Dutch Police and the National Cyber Security Center, more than 200 servers located in the Netherlands were used as backend infrastructure for the botnet. Authorities seized part of that infrastructure from a hosting provider, after which the provider reportedly took the platform offline following its use for criminal activity.
Although the botnet was not officially named in the public statement, local reporting has linked the operation to Asocks, a residential proxy service.
The takedown highlights a growing security problem: the abuse of residential proxy networks and compromised consumer devices to hide malicious traffic.
What Is a Botnet?
A botnet is a network of infected devices controlled by attackers.
These devices may include:
- personal computers
- smartphones
- tablets
- smart TVs
- routers
- cameras
- IoT devices
- other internet-connected equipment
Once compromised, the device can be remotely controlled without the owner’s knowledge. Attackers can then use the infected system to route traffic, launch attacks, hide their identity, or support criminal operations.
In many cases, users may not realize their device is part of a botnet. The device may still work normally, but in the background, it can be used for malicious activity.
Why Residential Proxy Botnets Are Dangerous
Residential proxies route traffic through real consumer internet connections.
There are legitimate uses for proxy services, such as testing websites, checking geo-restricted content, or protecting privacy. However, the same technology can be abused by criminals.
When attackers route malicious traffic through infected home devices, it becomes harder to block or trace because the traffic appears to come from normal residential users instead of suspicious data centers.
This can be used for:
- credential stuffing
- account takeover attempts
- web scraping
- fraud
- spam
- phishing infrastructure
- denial-of-service attacks
- scanning vulnerable systems
- hiding attacker infrastructure
For defenders, this creates a challenge. Blocking all residential IP addresses is usually not realistic, because legitimate users also connect from those networks.
The Scale of the Takedown
The reported scale of this botnet is significant.
A network of 17 million infected devices gives attackers enormous power and flexibility. Even if only a fraction of those devices are active at any one time, the botnet can still provide a large distributed platform for malicious activity.
The backend infrastructure was also substantial, with more than 200 servers located in the Netherlands supporting the operation.
This shows that modern botnets are not only malware infections on endpoints. They also depend on server infrastructure, hosting providers, proxy management systems, payment models, and customer access portals.
Taking down backend infrastructure can therefore disrupt the entire criminal service.
Possible Link to Asocks and PROXYLIB
While authorities did not explicitly name the botnet, local reporting connected the takedown to Asocks, a company offering residential, mobile, and corporate proxy services.
In 2024, HUMAN’s Satori Threat Intelligence team identified a campaign called PROXYLIB, which involved Android devices being infected with proxyware connected to LumiApps and Asocks.
Proxyware is software that turns a device into a proxy node. In some cases, users knowingly install proxyware in exchange for money or rewards. In other cases, proxy functionality may be bundled into apps without clear user understanding or may be installed through malicious activity.
This creates a gray area where commercial proxy networks, consent, malware, and cybercrime can overlap.
How Devices Become Part of a Botnet
Devices can be recruited into botnets in several ways.
Common infection methods include:
- malicious apps
- fake software updates
- compromised browser extensions
- weak or default passwords
- vulnerable routers
- outdated IoT firmware
- phishing links
- trojanized downloads
- exposed remote access services
- insecure Wi-Fi networks
Once attackers gain access, they can install malware or proxy components that allow remote control.
IoT devices are particularly attractive because many are poorly maintained, rarely updated, and often protected by weak or unchanged default passwords.
Why IoT Devices Are a Weak Point
Internet of Things devices are everywhere: cameras, routers, smart plugs, sensors, doorbells, TVs, printers, and network appliances.
Many of these devices are connected to the internet but receive limited security attention.
Common IoT weaknesses include:
- outdated firmware
- default admin passwords
- exposed management interfaces
- weak authentication
- no automatic updates
- poor vendor support
- insecure remote access
- lack of monitoring
Once compromised, an IoT device may remain infected for a long time because users rarely check logs or security status on these devices.
That makes IoT systems ideal for botnet operators.
Criminal Uses of Botnets
A botnet of this scale can support many types of malicious activity.
Attackers can use infected devices to:
- hide the source of attacks
- launch distributed denial-of-service attacks
- scan the internet for vulnerable systems
- perform password attacks
- automate fraud
- scrape websites
- bypass anti-bot protections
- relay phishing traffic
- support malware infrastructure
- route traffic for other criminal groups
Botnets are often rented or sold as a service. This means one criminal group may build the infrastructure while others pay to use it.
Disrupting such networks can therefore affect many different cybercrime operations at once.
Why the Takedown Matters
The takedown is important because it attacks the infrastructure layer of cybercrime.
Removing malicious servers does not automatically clean all infected devices, but it can prevent attackers from controlling the botnet or selling access to it.
It also sends a message to hosting providers, proxy operators, and cybercriminal users: infrastructure used for abuse can be identified and disrupted.
For users whose devices were infected, the takedown may stop malicious activity temporarily, but the underlying device weakness may still remain. If the malware persists or the device remains vulnerable, it could be recruited into another botnet later.
What Users Should Do
Home users should take basic steps to reduce the risk of their devices being recruited into botnets.
Recommended actions include:
- keep operating systems updated
- update router and IoT firmware
- change default passwords
- use strong, unique passwords
- enable two-factor authentication where available
- install apps only from trusted sources
- remove unused apps and browser extensions
- secure Wi-Fi with WPA2 or WPA3
- avoid unknown APKs or unofficial app stores
- restart routers and IoT devices periodically
- check for unknown devices on the home network
Users should pay special attention to routers, cameras, and Android devices, because these are common botnet targets.
What Organizations Should Do
Organizations should also treat botnets and proxy abuse as part of their threat model.
Recommended actions include:
- monitor login attempts from residential proxy networks
- detect credential stuffing patterns
- apply rate limiting to authentication endpoints
- enforce MFA
- block known proxy and botnet infrastructure where appropriate
- monitor unusual traffic from company-owned mobile or IoT devices
- maintain asset visibility for routers, cameras, and edge devices
- patch internet-facing systems quickly
- segment IoT networks from business systems
- review third-party proxy traffic patterns in fraud systems
Botnets are often used as infrastructure for attacks against businesses, so defenders should focus on behavior rather than only known bad IP addresses.
Final Thoughts
The Dutch takedown of a botnet involving at least 17 million infected devices shows how large and professionalized the proxy botnet ecosystem has become.
Criminals do not always need their own servers to hide attacks. They can route traffic through infected residential devices, making malicious activity appear to come from ordinary users.
This creates risk for everyone: device owners, businesses, service providers, and internet platforms.
The best defense is a combination of law enforcement disruption, responsible hosting practices, device hygiene, strong authentication, regular patching, and better visibility into internet-facing and IoT assets.
Botnets thrive on forgotten devices. Keeping systems updated, monitored, and properly secured remains one of the simplest ways to reduce their power.
