Attacker brute-forced 87,000 legacy VPN IPs with default passwords and a modified Claude Code CLI

What happened

One attacker compromised more than 87,000 IP addresses by brute-forcing devices running PPTP and L2TP, then rented the addresses out as proxies and collected roughly $202,000 since 2024. According to a case report attributed to escudodigital.com and Cybernews, summarised in a dev.to write-up, the campaign was run by a single operator who automated the whole thing with a modified version of Claude Code, Anthropic's command-line coding assistant.

How the attack worked

There was no zero-day and no cryptographic break. The targets were devices still speaking PPTP or L2TP, two aging VPN protocols that survive in many networks, and the attacker tried factory-default username and password combinations of the "admin123" variety — logins that ship on the hardware and are frequently never changed.

Every device that accepted a default login became stock. The compromised IPs were pooled and offered as proxy endpoints, turning other people's gateways into a commercial proxy service.

The notable part is the tooling. Rather than a roster of operators, the campaign was driven by a repurposed AI coding CLI: the attacker altered Claude Code to carry out the repetitive mechanics end to end, according to the dev.to write-up. Software built to speed up development work was refashioned into the motor of a proxy operation run by one person.

The identity pattern

The incident sits inside a broader trend. Mandiant's AI Risk and Resilience 2026 report, cited in the same write-up, describes threat actors moving from experimenting with AI to running it in live operations, with prompt injection the dominant vector in self-hosted deployments. Unit 42 and Mandiant add a framing number: 65% of initial access now arrives through identity, and an intrusion cycle can finish within minutes.

The proxy case is that statistic in miniature. The attacker never had to defeat the protocols' encryption, only to find hosts where a default login still worked. In other intrusions the borrowed credential is a token, a session or a service account; here it was a default password nobody rotated.

Checking your exposure

The write-up's recommendations map directly onto the incident:

• Audit the VPN inventory for PPTP and L2TP endpoints and retire anything with no clear owner.
• Replace factory credentials everywhere, starting with edge devices whose management interfaces face the internet.
• Trim identity permissions: with most initial access arriving through identity, the sharper question is which accounts can reach production alone, not which patch is missing.

Why it matters

This story is mostly about legacy exposure rather than AI ingenuity. Internet-facing devices that still accept their factory logins are commodity assets, and this case puts a price on them: about $202,000 for one operator, for the cost of automated guessing. The AI component matters because it changes the economics on the attacker's side — a single person with a modified CLI can now sustain an operation that previously demanded staffing. For defenders, that turns unowned legacy VPN services from backlog hygiene into something more urgent: they are the raw inventory of somebody else's business.