One attacker rented 87,000 IPs using a modified AI CLI

An attacker compromised over 87,000 IP addresses by brute-forcing factory-default admin123 credentials on devices running legacy PPTP and L2TP VPN protocols. Renting the IPs out as proxies earned $202,000 since 2024, with the operation automated through a modified version of Claude Code.

• Over 87,000 IPs compromised via PPTP and L2TP brute force
• Proxy rental earned $202,000 since 2024
• Attack automated with a modified version of Claude Code
• Mandiant: 65% of initial access comes through identity