Talos Warns of Rising Brute-Force Attacks on VPNs, SSH and Web Logins
Summary
Talos reports a rise in brute-force attacks since at least March 18, 2024, targeting VPNs, web application logins and SSH. The activity uses common and organization-specific credentials and appears to originate from anonymizing services.
Key points
- Talos has tracked a global increase in attacks since at least March 18, 2024.
- Targets include VPN services, web application authentication interfaces and SSH, with several VPN vendors and other services named.
- Attempts use generic usernames and valid usernames for specific organizations; targeting appears indiscriminate.
- Traffic appears to come from TOR exit nodes and other anonymizing tunnels and proxy services, whose IP addresses may change.
- Successful attacks could enable unauthorized network access or cause account lockouts or denial of service.
- Talos added known associated IP addresses to its blocklist and published related IP addresses and credentials as IOCs.
- Mitigations vary by affected service; Talos points to separate guidance for Cisco remote-access VPN services.
Article Details
- Event Type
- Large-scale brute-force attacks against VPN services, web application authentication interfaces, and SSH services.
- Impact
- Successful attacks could lead to unauthorized network access, account lockouts, or denial-of-service conditions. Cisco Talos reported a significant increase in attack traffic and added known associated IP addresses to its blocklist; the source IP addresses may change.
People
Anna BennettCisco Talos researcher acknowledged for research that led to identification of the attacks.Becca LynchDuo Security Research team member acknowledged for research that led to identification of the attacks.Brandon WhiteCisco Talos researcher acknowledged for research that led to identification of the attacks.Mike MoranDuo Security Research team member acknowledged for research that led to identification of the attacks.Phillip SchaferDuo Security Research team member acknowledged for research that led to identification of the attacks.