A large-scale brute force password attack using almost 2.8 million IP addresses is underway, attempting to guess the credentials for a wide range of networking devices, including those from Palo Alto Networks, Ivanti, and SonicWall.
I have commentary on this from a variety of experts. Starting with Erich Kron, Security Awareness Advocate at KnowBe4:
“VPNs are a great target for bad actors because in a corporate world, they can lead to direct access to the network behind the protection of firewalls and other edge security devices. If these bad actors are able to guess or brute force the VPN password, cybercriminals could attempt anything from data theft to ransomware, or more. In many cases, cybercriminals could simply sell this network access to other bad actors as well, pocketing the cash and letting the buyer do whatever nefarious deeds they would like.”
“These types of attacks trying to break into networks though VPNs are often driven by processes such as ‘password spraying,’ which is using a predefined list of simple or common passwords, and a list of known email addresses or usernames, or through ‘credential stuffing,’ which is using a list of usernames and passwords stolen in other data breaches or by tricking employees to give up credentials through fake login portals. The use of MFA, or some other sort of secondary authentication technology, can help stop the ability of bad actors to log in, however, it is not foolproof.”
“By using so many IP addresses that are scattered throughout the globe to carry out these attacks, the cybercriminals can make it extremely difficult for defenders to stop the brute force attacks attempting to pierce the protections put in place by targeted organizations. These source IP addresses are often from individual computers infected with malware, IoT devices that have been compromised, or out of date consumer routers or internet facing devices that attackers have already taken over.”
“These sorts of attacks stress the importance of educating employees about good password hygiene, including not reusing passwords that may have been stolen in other breaches, and the need for a second factor of authentication for any important accounts, especially those that can access the organization from the internet.”
Next up is Chris Hauk, Consumer Privacy Champion at Pixel Privacy:
“Brute force password attacks have long been and will continue to be, a popular method of attacking systems, websites, VPN appliances, and other password-protected devices. While there are more sophisticated ways to perform attacks, hackers depend on the fact that their targets haven’t been kept updated to the latest software, firmware, or operating system versions, or that the device’s logins aren’t protected with two-factor or multi-factor authentication methods.”
Finally we have Brian Higgins, Security Specialist at Comparitech:
“This uptick in high-volume activity is symptomatic of the monetary allure that access dangles in front of cyber-criminal enterprises. Although such a massive brute-force endeavor smacks a little of the old ‘spray and pray’ methodology, the sheer volume and potential value of online targets these days makes the whole thing worthwhile. If anyone still hasn’t switched to Two or Multi Factor authentication or is adamantly clicking ‘ask me later’ when they see an update prompt, then this should be their final warning. There is research that says we will hit 75 billion connected devices in 2025 so Bot-Nets will only get bigger and from a criminal’s point of view, there’s no point letting them sit idle.”
Solutions such as MFA/2FA as well as totally passwordless solutions are no longer optional based on an attack like this one. Because when attacks like this one succeed, they have grave consequences for the organization at the receiving end.
UPDATE: Darren James, Senior Product Manager at Specops Software, commented:
“Brute Force attacks aren’t usually very sophisticated, but this example does certainly seem to demonstrate a well-planned and determined attack against its potential victims using such a large number of compromised devices based all over the globe.
The benefit of a brute force attack of this nature is that it’s in no hurry to crack the security of a specific individual, but instead targets hundreds, thousands maybe even millions of individual user accounts, trying to connect using a list of already known breached passwords, once it finds a match it might then proceed to deliver a payload or it may just keep that user/password pair to one side to be used later or sold on to the highest bidder.
This process usually takes a lot of time, but by simultaneously using 2.8 million devices they can certainly speed up this type of attack and the amount of positive “hits” they get.
From our own recent research we found that “admin” was still one of the most common base terms used in breach passwords, so it’s vitally important to make sure that the admin interfaces of these VPN and Firewall servers and devices that are being targeted are not using easily guessable passwords or default passwords set by their manufacturers.
Even if those passwords have been changed, organizations should also continuously scan to make certain that the passwords that have been set haven’t themselves become breached.
Implement MFA on these devices. This can be done using RADIUS authentication if there’s no secure built-in 2FA option, and finally consider whether you need to expose the admin interface externally, usually this is not a good idea, but could have been left over from a support session.”
This is also being reported by Bleeping Computer and has been tracked by The Shadowserver Foundation.
UPDATE #2: Lawrence Pingree, VP, Dispersive adds this:
This problem is solved by separating the control plane and data plane for VPNs and transport infrastructure, as we do. A recent analysis of 2024 breaches found that over 56% of enterprises experienced an attack related to their VPNs (report link: https://blog.dispersive.io/vpns-under-siege-2024-cyber-attacks-data-breach-in-review ). I do not think most Zero Trust providers are immune to this same style of attack.
Guest Post: Safer Internet Day – Getting Serious With Passwords
Posted in Commentary with tags Specops on February 11, 2025 by itnerdBy Darren James – Senior Product Manager and cyber security expert at Specops Software
To celebrate Safer Internet Day (SID) and raise further awareness around promoting the safe and positive use of digital technology for the theme “Together for a better Internet,” we’ve decided to focus on a critical element within security that many people will be familiar with but seemingly don’t give due attention: passwords.
For the modern person, our daily lives largely involve the internet. Whether that be online banking, connecting with friends and family on social media, checking email, shopping for groceries, or so on. Access to all of these services requires a login and a password. Now, you may think users are using strong, unbreakable, long passwords, not least because many sites now mandate passwords to meet certain requirements. After all, passwords are often all that separates the outside world from gaining entry to our sensitive information.
However, this isn’t the case as many people are still either not changing the default password or using generic, easy-to-crack credentials instead. Speaking plainly, most of us are guilty of using lazy passwords, or reusing credentials at some point in our lives.
This poor display of security behaviour is very visible in the working world and our recent findings in the 2025 Breached Password Report only highlight the critical importance of SID’s mission in improving cybersecurity habits for everyone.
The password “123456” was the most frequently compromised, appearing in more than 1.4 million leaked credentials. Alarmingly, among the 1.8 million breached administrator credentials, 40,000 admin portal accounts used “admin” as the password, highlighting that even IT professionals may not be prioritizing security.
Over a 12-month period, more than one billion credentials and passwords were stolen through malware attacks. This alarming statistic underscores the need for robust cybersecurity measures and increased awareness about online threats.
One of the key findings is that 230 million of the stolen passwords met common complexity requirements (over eight characters, including uppercase letters, numbers, and special characters). This indicates that adhering to standard password policies alone is insufficient to protect against sophisticated attacks.
With breaches often costing companies millions for each incident, the cost of lazy passwords could be seriously detrimental to any business.
The stats highlight the brutal truth that relying on end users to maintain strong password security is a losing battle. Even with cybersecurity training and strict password policies, human error remains the weakest link. Security professionals must take a proactive approach (that does not rely on end users) by implementing robust security measures – such as multi-factor authentication (MFA) and password managers – rather than assuming awareness alone will keep systems secure.
Enhancing password security is crucial for protecting organizations against cyber threats. Here are five key tips to strengthen your organization’s password practices:
Train Employees on Secure Password Practices
Educate staff on password security risks, such as weak storage methods and easily guessed passwords. Ultimately, we want to help users by providing detailed, local language feedback when they set or change their passwords.
Enforce Strong Password Policies
We want to encourage the use of longer passphrases, using memorable words so that users are less likely to write them down. Policies can include increased password expiry time but to avoid users incrementing the same password, organizations must continuously check the password and require it to be changed if it becomes breached. Furthermore, certain departments or individuals may require specific password policies for compliance requirements, so this needs to be accounted for.
Defend Against Brute-Force Attacks
Protect accounts by locking them after multiple failed login attempts and blocking suspicious IP addresses. Configure these settings in Active Directory and other security systems. Organizations can start by blocking easy-to-guess passwords that might relate to the company or business.
First-Day Password & Promptly Deactivate Departing Employee Accounts
When a new employee joins, having a “First Day Password” security capability will enable the user to securely set their initial password, eliminating the need for IT to share temporary credentials and reducing onboarding security risks. Moreover, when an employee leaves the company, immediately disabling accounts will prevent unauthorized access. Updating shared passwords will also minimize security risks.
Implement Multi-Factor Authentication (MFA)
Strengthen security by requiring multiple verification steps, ensuring access is not solely dependent on passwords.
With Safer Internet Day 2025, we can’t let another year pass and not take the required action. It’s imperative to reflect on these findings and take proactive steps to safeguard our digital lives. By working together, we can create a more secure and trustworthy internet for all. Furthermore, by adopting these strategies, your organization can significantly improve its password security posture and reduce the likelihood of breaches related to compromised credentials.
Leave a comment »