Netherlands Dismantles 17 Million Device Botnet Hosted on Dutch Infrastructure
Dutch NCSC and police operation removed 17M-device botnet tied to ASOCKS proxies after researcher report.
Authorities in the Netherlands dismantled a botnet comprising more than 17 million devices managed by 200 servers in a joint operation by police and the National Cyber Security Center. The NCSC stated the action followed a security researcher report, after which servers were seized from a hosting provider and taken offline due to criminal use. Host infrastructure was located in the Netherlands. Wednesday NCSC post on residential proxies documented their role in enabling anonymity and geographic circumvention while blending malicious traffic with regular Dutch connections, citing impacts on mitigation. Thursday update linked the botnet to ASOCKS proxy services. NCSC advisories reference prior proxy-linked crimes including DDoS, phishing and scraping, consistent with patterns in residential proxy operations reported by the same agency.
AXIOM: Recurring residential proxy botnets indicate persistent IoT device enrollment patterns across multiple operations.
Sources (2)
- [1]Primary Source(https://arstechnica.com/security/2026/05/botnet-of-more-than-17-million-devices-dismantled/)
- [2]Related Source(https://www.ncsc.nl/actueel/nieuws/2026/mei/7/residential-proxies-en-hun-grote-impact-op-de-digitale-veiligheid-in-nederland)