Law Enforcement Wins Drive Criminals Toward Harder-to-Disrupt Proxy Networks

International takedowns of criminal VPN services like Safe-Inet, VPNLab.net, and DoubleVPN (2021–2024) have forced threat actors to adopt more resilient infrastructure. The 911 S5 botnet exemplified the shift: instead of renting server-based anonymization, criminals now distribute trojanized free VPN apps that convert millions of compromised consumer devices into residential proxies. This evolution suggests law enforcement's infrastructure-focused approach, while tactically effective, inadvertently incentivizes criminals toward decentralized architectures that are fundamentally harder to disrupt.