A botnet of 17 million hijacked devices has been dismantled — and it was reportedly a front for a Russian proxy service

Law enforcement took down one of the largest botnets on record. The infrastructure was allegedly used to sell anonymized internet traffic through a residential proxy network.

Written by Lena Armitage · Bureau Tech · Jun 1, 2026

One of the largest botnet takedowns on record

Authorities have dismantled a botnet — a network of devices infected with malware and controlled remotely without their owners' knowledge — that encompassed more than 17 million machines. If that figure holds up, it ranks among the largest single botnet disruptions ever recorded.

The scale matters. Most botnets that make headlines number in the hundreds of thousands to low millions of devices. Seventeen million represents an order-of-magnitude jump that suggests either an unusually effective infection campaign, a long operational runway before detection, or both.

The residential proxy angle

What makes this case particularly notable is the alleged business model behind it. According to reporting by Ars Technica, the botnet was tied to a Russia-based **residential proxy network** — a type of service that deserves a clear definition.

A residential proxy network works by routing a paying customer's internet traffic through the IP addresses of real consumer devices rather than through obvious data-center servers. For the customer, this provides a layer of anonymity: their requests appear to come from an ordinary home broadband connection in, say, Chicago or Warsaw, not from a commercial server farm. Legitimate uses exist — some companies use residential proxies for market research or ad verification — but the infrastructure is also widely abused for credential stuffing attacks, ad fraud, and evading geographic restrictions.

When the devices in that proxy pool are infected without their owners' consent, the operation crosses clearly into criminal territory. The device owners become unwitting infrastructure for someone else's anonymization service.

What we don't yet know

The available reporting leaves meaningful gaps. It is not yet confirmed which law enforcement agencies led or participated in the takedown, what legal authorities were invoked, how the 17 million devices were initially compromised, or whether any arrests have been made. Ars Technica's coverage, which is the primary source for this story, attributes the Russia connection to reporting rather than confirmed official statements — a distinction worth preserving.

Bureau will update this article as more details become available through official channels.

Why scale and attribution both matter

Botnet takedowns are not permanent solutions. Infrastructure can be rebuilt, and operators who remain at large often do exactly that. The 2014 Gameover Zeus takedown, for instance, disrupted a botnet of roughly one million devices — and while it was a significant law enforcement achievement, it did not end the underlying criminal ecosystem.

At 17 million devices, the potential for disruption to ordinary users — whose machines may have been silently recruited into this network — is substantial. Whether the takedown included any mechanism to notify and remediate affected device owners is another open question the current reporting does not resolve.

Key takeaways

More than 17 million devices were part of the botnet at the time of dismantlement, a scale that places this among the largest such operations ever disrupted.
The botnet was reportedly tied to a Russia-based residential proxy network — a service that monetizes hijacked devices by routing third-party traffic through them to mask its origin.
Residential proxy networks are particularly difficult to detect because the traffic appears to originate from ordinary consumer IP addresses rather than data centers.
The full scope of who operated the network, how devices were infected, and which law enforcement agencies led the operation has not been fully confirmed in available reporting.
Takedowns of this scale are rare and operationally complex, often requiring coordination across multiple national jurisdictions.

FAQ

What is a botnet?

A botnet is a network of internet-connected devices that have been infected with malware and are being controlled remotely, typically without the knowledge of the devices' owners. Operators use botnets for a range of purposes including sending spam, conducting distributed denial-of-service (DDoS) attacks, stealing credentials, or — as in this case — providing proxy services.

What is a residential proxy network and why is it hard to detect?

A residential proxy network routes internet traffic through the IP addresses of real consumer devices rather than data-center servers. Because the traffic appears to originate from ordinary home connections, it is much harder for websites and security systems to flag as suspicious compared to traffic from known commercial IP ranges.

How does a device end up in a botnet like this?

Devices are typically recruited into botnets through malware delivered via phishing emails, malicious downloads, exploitation of unpatched software vulnerabilities, or compromised routers and IoT devices with weak default credentials. Owners are usually unaware their device has been compromised.

Does a takedown like this permanently shut down the operation?

Not necessarily. Law enforcement takedowns disrupt existing infrastructure, but operators who are not arrested can rebuild. Historical precedent — including the Gameover Zeus takedown in 2014 — shows that even large, well-publicized disruptions do not always permanently neutralize the underlying criminal networks.

What should I do if I think my device was part of this botnet?

At this stage, no official remediation guidance has been published based on available reporting. General best practices include keeping device firmware and software fully updated, running reputable security software, and changing default credentials on routers and IoT devices. Bureau will update this article if official guidance is released.

Citations

Botnet of more than 17 million devices dismantledA botnet of more than 17 million devices was dismantled; the network was reportedly tied to a Russia-based residential proxy service.
Ars Technica Security FeedSecondary source confirming Ars Technica as the originating publication for this report.
U.S. DOJ: Gameover Zeus Botnet Disrupted (2014)Historical precedent: the 2014 Gameover Zeus takedown disrupted a botnet of approximately one million devices, illustrating that large-scale takedowns do not always permanently neutralize criminal infrastructure.