Continued widespread dictionary / brute force attacks

CTC NEWS, Industry News
Over the past two weeks, we have seen a significant spike in the number of brute force attacks against SSL VPN endpoints and VPN web portals. Initially, the traffic was coming from several hundred IP Addresses but we were pretty quickly able to distill it down to about 47 netblocks from two geographic areas (Russian Federation and China). All of the login attempts were failing and in the initial set of login attempts the usernames were varied and included admin, administrator, vpnuser, sslvpn, backup, user, sales and others. This most recent set of attempts though were for admin and administrator and, after distilling the data down we saw a new pattern emerge. A very small number of the attempts are now coming from domestic IP Addresses and, specifically, some of…
Read More

Widespread brute force / dictionary attacks overnight

Industry News, Tech news
We received notifications from literally every Internet facing firewall that we have deployed as well as a number of honeypot devices for failed login attempts from an IP Address This IP Address is in the same network ( that we've seen similar traffic from in the past and we have no indication of any legitimate traffic to or from that network in the past 12 months. If you manage one or more networks with Internet connectivity, it may be worth looking into this network range to see if there has been any traffic (or successful logins). For our MyIT clients, we had already blocked a few specific IP Addresses based on similar traffic in the past but are now updating all of our managed firewalls to block the entire…
Read More