Cybercriminals often need infrastructure that helps hide where their activity originates.
Proxy services can provide that layer by routing traffic through other systems.
In 2026, law enforcement targeted criminal proxy infrastructure associated with services such as SocksEscort.
The important lesson is that cybercrime is supported by an ecosystem of services.
Attackers do not necessarily build every server, proxy and credential store themselves. They can obtain components from other criminals.
For defenders, this means blocking one malicious address is rarely enough. Infrastructure changes.
For users, it reinforces why account security and verification matter. The technical infrastructure behind a scam can disappear and reappear elsewhere, while the social-engineering technique remains the same.