What can we learn from the passwords used in brute-force attacks?
Summary: Cisco Talos published a list of IP addresses, usernames and passwords adversaries typically try in brute-force attacks on SSH and VPN services, including classics such as "Password," "Passw0rd" and "123456," alongside entries like "Mart1x21," "Spring2024x21" and "April2024x21." The article also notes that the U.K.'s Product Security and Telecommunications Infrastructure (PSTI) rules took effect last month, requiring manufacturers to force users to change default passwords and stop them from using easy-to-guess ones like "Admin" and "12345."
What you should know: Attackers are still guessing "Password" and "123456" because someone out there is still using them, and the article reports that for the first time in several quarters business email compromise was the most common threat in Talos IR engagements in Q1 2024 at 46 percent, up sharply from Q4 2023.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026