Despite multiple takedowns, botnets continue to grow
Botnets are growing despite takedowns, with residential proxy networks enabling evasion.
Residential proxy botnets are rapidly expanding, with Lumen's Black Lotus Labs reporting nearly 60 million victim IPs globally. These botnets are resilient, with some like IPIDEA rebounding quickly after disruptions and surpassing previous sizes. The growth is fueled by a consistent demand for compromised IPs, a large pool of vulnerable devices, and a collaborative supply chain among malicious proxy services.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Lumen?
Get an email when a new story names Lumen, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe rapid expansion of residential proxy botnets to nearly 60 million compromised IPs highlights a systemic failure in vulnerability management across consumer and IoT devices. Attackers exploit a large pool of unpatched, misconfigured, or poorly secured devices to sustain and grow their infrastructure, even after law enforcement takedowns. The resilience of botnets like IPIDEA demonstrates that reactive disruptions without addressing the underlying supply of vulnerable devices are insufficient. This matters because compromised residential IPs are used to mask malicious traffic, enabling fraud, credential stuffing, and other attacks that evade IP-based defenses.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.