{"id":15843,"date":"2025-04-21T07:49:12","date_gmt":"2025-04-21T07:49:12","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/hackers-abuse-proton66-for-malware\/"},"modified":"2025-04-21T07:49:13","modified_gmt":"2025-04-21T07:49:13","slug":"hackers-abuse-proton66-for-malware","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/hackers-abuse-proton66-for-malware\/","title":{"rendered":"Hackers Abuse Proton66 for Malware"},"content":{"rendered":"\n<\/p>\n

Cybersecurity Alert: Russian Bulletproof Host Proton66 Linked to Surge in Malicious Activity<\/strong><\/p>\n

\ue802<\/i>Apr 21, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Vulnerability \/ Threat Intelligence<\/span><\/p>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Cybersecurity researchers at Trustwave SpiderLabs have identified a significant increase in malicious activity, including mass scanning, credential brute-forcing, and exploitation attempts, originating from IP addresses associated with the Russian bulletproof hosting service provider Proton66.<\/p>\n

This surge in activity, detected since January 8, 2025, has targeted organizations worldwide, according to a two-part analysis published by Trustwave SpiderLabs. The research highlights the involvement of Proton66’s net blocks, particularly 45.135.232.0\/24 and 45.140.17.0\/24, in mass scanning and brute-force attempts.<\/p>\n

Security researchers Pawel Knapczyk and Dawid Nesterowicz noted that several of the offending IP addresses were previously inactive or had not been involved in malicious activity for over two years. The Russian autonomous system Proton66 is believed to be linked to another autonomous system named PROSPERO, which has been connected to bulletproof services marketed on Russian cybercrime forums under the names Securehost and BEARHOST.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Proton66 has hosted command-and-control (C2) servers and phishing pages for several malware families, including GootLoader and SpyNote. In February 2025, security journalist Brian Krebs revealed that Prospero had begun routing its operations through networks run by Russian antivirus vendor Kaspersky Lab in Moscow. However, Kaspersky denied any involvement with Prospero, stating that the routing of operations through their networks does not imply provision of services.<\/p>\n

Trustwave’s analysis revealed that malicious requests from one of Proton66’s net blocks attempted to exploit critical vulnerabilities, including:<\/p>\n