Enquire Now   |
Call Us Now
+91 7709988854

Blog Details

From CVEs to CCTV

From CVEs to CCTV: Inside an AI-Assisted Exploit Repository Targeting Internet-Facing Infrastructure

 

Overview

During our investigation, we identified hundreds of offensive resources, including exploit scripts targeting recently disclosed CVEs, web shell generators, phishing frameworks, credential theft utilities, command-and-control (C2) components, persistence mechanisms, malware builders, VPN and tunneling tools, and AI-generated exploit development artifacts. The repository demonstrates a highly automated attack workflow that significantly reduces the technical barrier for conducting sophisticated cyber operations.

One of the most significant findings was the discovery of operational artifacts indicating access to Internet-exposed CCTV and Network Video Recorder (NVR) interfaces. Screenshots and associated files suggest that surveillance infrastructure had been accessed or monitored, demonstrating that attackers are extending their focus beyond traditional enterprise applications to Internet-connected physical security systems. Such infrastructure can provide valuable reconnaissance, facilitate unauthorized monitoring, or serve as additional footholds within targeted environments.

 

Key Observations

  1. Repository contains public PoC exploits, Python/PHP scripts, Nuclei templates, WP2Shell, Sliver, WireGuard, and operational artifacts supporting multiple attack stages.
  2. Tooling targets RCE, Authentication Bypass, Directory Traversal, Code Injection, Information Disclosure, and NTLM Hash Disclosure vulnerabilities.
  3. Primary targets include Internet-facing web applications, VPNs, security appliances, Windows/Linux servers, IoT devices, and CCTV/NVR systems.
  4. Exploits cover multiple critical CVEs, including CVE-2025-24071, CVE-2025-31324, CVE-2025-25257, CVE-2025-49113, CVE-2025-24813, CVE-2022-1040, CVE-2019-19781, and CVE-2017-7921.
  5. Nuclei templates indicate automated reconnaissance and large-scale vulnerability scanning.
  6. Python and PHP scripts enable automated exploitation, payload execution, and post-exploitation activities.
  7. WP2Shell indicates capability to deploy web shells and maintain web-based access.
  8. Sliver provides command-and-control (C2) capabilities for remote access and payload management.
  9. WireGuard may be used to establish encrypted tunnels for secure attacker communications.
  10. References to Kimi AI suggest possible AI-assisted exploit development and automation.
  11. The fvds/reports/ directory contains screenshots appearing to show access to CCTV/NVR management interfaces.
  12. The toolkit supports exploitation across Windows, Linux, enterprise applications, security appliances, and embedded IoT platforms.
  13. The combined tooling reflects a complete attack chain from reconnaissance to post-exploitation.
  14. The absence of custom malware or persistence mechanisms suggests a focus on initial access and compromise staging.
  15. Overall, the repository aligns with tooling commonly associated with opportunistic Initial Access Broker (IAB) or financially motivated operations leveraging publicly available resources.

Threat Actor Profile


Discovery – Advanced Toolsets on the C2 server – July 2026

On 28 July 2026, during a routine OSINT investigation, the Threat Intelligence team identified a publicly accessible Open Directory hosting a large collection of offensive security tools, exploit frameworks, AI-assisted code artifacts, scanning utilities, and operational directories.

https://urlscan.io/result/019fa683-a425-7169-b6bd-65b798cf6c6a/

 

threat actor cctv

Further revalidation activity revealed that we observed this server is not reachable on 1st August 2026.

https://urlscan.io/result/019fbca9-c186-750e-8397-6f3239b697f4/

threat actor cctv.png3
threat actor cctv.png 2

 

Repository Overview

Our analysis identified a publicly accessible repository containing a broad collection of offensive tooling and operational artifacts, including:

  1. Public Proof-of-Concept (PoC) exploit scripts
  2. Python and PHP exploitation tools
  3. Nuclei reconnaissance and vulnerability scanning templates
  4. AI-assisted code artifacts referencing Kimi AI
  5. WP2Shell web shell deployment utility
  6. Sliver Command-and-Control (C2) framework
  7. WireGuard secure tunneling components
  8. Exploit artifacts targeting recent and legacy CVEs
  9. Operational reports containing screenshots of CCTV/NVR management interfaces and camera footage

Collectively, these artifacts indicate a toolkit capable of supporting multiple phases of the intrusion lifecycle, including automated reconnaissance, vulnerability exploitation, web shell deployment, command-and-control, encrypted communications, and post-exploitation activities across a wide range of Internet-facing infrastructure.

Tools Discovered at the Command & Control Server

1. kimi

Moonshot AI‘s Kimi AI is one of the strongest AI assistants available today, especially for software engineering, cybersecurity research, long-context analysis, and agentic workflows. It has evolved from a chat assistant into a full AI productivity platform with coding, document processing, research, website generation, and APIs.

2. sliver

During our infrastructure analysis, we identified an internet-facing server hosting the Sliver Command-and-Control (C2) framework.

3. CCTV/NVR Operational Artifacts

One of the most significant findings was the discovery of operational artifacts indicating access to Internet-exposed CCTV and Network Video Recorder (NVR) interfaces. Screenshots and associated files suggest that surveillance infrastructure had been accessed or monitored, demonstrating that attackers are extending their focus beyond traditional enterprise applications to Internet-connected physical security systems. Such infrastructure can provide valuable reconnaissance, facilitate unauthorized monitoring, or serve as additional footholds within targeted environments.

cctv

 

Vulnerabilities Targeted

The repository targets multiple high-impact vulnerability classes, including:

  1. Remote Code Execution (RCE)
  2. Authentication Bypass
  3. Directory Traversal
  4. Information Disclosure
  5. NTLM Hash Harvesting

Observed CVEs include:

 

MITRE ATT&CK Framework Alignment

  1. T1190 – Initial Access – Exploit Public-Facing Application
  2. T1595 – Reconnaissance – Active Scanning
  3. 002 – Reconnaissance – Vulnerability Scanning
  4. T1212 – Initial Access – Exploitation for Credential Access
  5. T1187 – Credential Access – Forced Authentication
  6. 006 – Execution – Python
  7. 001 – Execution – PowerShell / Command Interpreter
  8. T1105 – Ingress Tool Transfer – Ingress Tool Transfer
  9. 003 – Persistence – Web Shell
  10. T1210 – Lateral Movement – Exploitation of Remote Services

Threat Hunting Hypothesis

An opportunistic threat actor or Initial Access Broker (IAB) is likely conducting large-scale automated reconnaissance against Internet-facing enterprise infrastructure using vulnerability scanning tools such as Nuclei. The objective is to identify exposed applications, edge devices, security appliances, and surveillance systems affected by publicly disclosed vulnerabilities.

Upon identifying vulnerable assets—including Apache Tomcat (CVE-2025-24813), SAP NetWeaver (CVE-2025-31324), Roundcube Webmail (CVE-2025-49113), Citrix ADC/Gateway (CVE-2019-19781), Hikvision (CVE-2017-7921), and Geutebruck G-Core/G-Cam (CVE-2025-25257)—the adversary is assessed to leverage Python- and PHP-based exploit scripts to automate unauthenticated Remote Code Execution (RCE), authentication bypass, or information disclosure.

Following successful exploitation, the operator is likely to:

  1. Spawn interactive command shells (cmd.exe, powershell.exe, /bin/sh, or /bin/bash) to execute system commands.
  2. Deploy web shells using tooling such as WP2Shell to establish persistent web-based access.
  3. Utilize Sliver for command-and-control (C2), payload management, and post-exploitation tasking.
  4. Establish encrypted communication channels using WireGuard to securely connect compromised systems with attacker-controlled infrastructure.
  5. Upload secondary payloads or staging scripts into web-accessible directories.
  6. Harvest NTLM credentials through exploitation of CVE-2025-24071 to facilitate credential theft, relay attacks, or lateral movement.
  7. Enumerate and validate exposed CCTV/NVR platforms, as indicated by operational artifacts and screenshots found within the repository.

The combination of automated reconnaissance templates, exploit scripts, post-exploitation tooling, encrypted tunneling capabilities, and documented surveillance system access suggests a scalable attack workflow optimized for rapidly compromising Internet-facing assets. This activity is consistent with the tactics of opportunistic Initial Access Brokers (IABs) or financially motivated threat actors seeking to obtain, monetize, or resell unauthorized access rather than conduct highly targeted intrusions.

Threat Intelligence

Emerging attacker infrastructure often precedes widespread reputation-based detection. By correlating infrastructure, behavioral patterns, and attacker tradecraft, threat intelligence enables defenders to identify potential threats earlier, reducing reliance on signatures and reputation alone.

1. Virustotal detection
virus total
virus total
2. Sicehice Detection
sicehice
3. AlienVault Detection
4. Hybrid-Analysis Detection
Hybrid

Mitigation Recommendations

  1. Enforce aggressive patch management policies to remediate known vulnerabilities (CVE-2025-24813, CVE-2025-31324, CVE-2025-49113, CVE-2025-25257) on all public-facing assets.
  2. Restrict outbound SMB traffic (TCP Port 445) at the perimeter firewall to prevent NTLM credential exposure to untrusted external hosts.
  3. Place admin web consoles, management interfaces, and surveillance gateways behind zero-trust network access (ZTNA) or enterprise VPN solutions.
  4. Implement Web Application Firewalls (WAF) with updated signature sets to inspect and block directory traversal, RCE, and payload injection patterns.
  5. Enforce principle of least privilege for application service accounts (e.g., Tomcat, Apache), disabling interactive login shell permissions (`/sbin/nologin`).
  6. Segment physical security networks (IP cameras, CCTV systems) from corporate enterprise zones using strict VLAN controls.
  7. Enforce Endpoint Detection and Response (EDR) agent deployment on all web application hosting hosts to block anomalous process creation.
  8. Disable unnecessary file upload endpoints or enforce strict content and extension validation on web applications.
  9. Configure Extended NTLM Protection (EPA) and disable legacy NTLM authentication across Windows environments where feasible.
  10. Restrict interpreter execution (`python.exe`, `php.exe`, `powershell.exe`) to authorized administrative service accounts and paths.

Explore Threat Hunting Hypothesis

Explore detailed Threat Hunting Hypothesis, MITRE ATT&CK mapping, behavioral indicators, and platform-specific detection queries on the Threatactix Threat Intelligence Portal.

Click here