Mass Scanning and Exploit Campaigns
Essential information
- Published
- 16/05/2025 08:51
- Modified
- 21/05/2025 21:05
- Tags
- 2025-05-16 CVE-2024-10914 CVE-2024-41713 CVE-2024-55591 CVE-2025-0108 CVE-2025-24472 bulletproof hosting critical vulnerabilities exploit campaigns mass scanning ransomware superblack underground forums vulnerability exploitation
- Related entities
- 5 vulnerabilities (cve), 22 observables, 1 intrusion sets (apt), 11 techniques (mitre), 1 malware, 6 others
Description
Trustwave SpiderLabs has identified ongoing malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns. The investigation revealed connections between Proton66 and bulletproof hosting services advertised on underground forums. Mass scanning and exploit campaigns targeting multiple sectors were observed, with technology and financial organizations being the most common targets. A specific IP address linked to SuperBlack ransomware operators was found distributing critical exploits. The analysis also uncovered a potential rebranding of underground hosting services and shifts in IP addresses between different ASNs, suggesting relationships between providers.