Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials
Summary: Cisco Talos has monitored a global increase in brute-force attacks against VPN services, web application authentication interfaces, and SSH services since at least March 18, 2024, with traffic appearing to originate from TOR exit nodes and other anonymizing tunnels and proxies. The attacks use generic usernames and valid usernames for specific organizations, appear indiscriminate by region or industry, and can lead to unauthorized network access, account lockouts, or denial-of-service conditions.
Bottom line: The traffic has increased over time and is likely to keep rising, and because the source IPs are proxy services that are likely to change, blocklists alone will not hold the line against credential-based entry into your remote access services.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-20127
- Related
- Inside Key Drift: Analyzing historical UAT-11473 activity on Cisco SD-WAN Cyber Risks · Oct 28, 2026CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Feb 25, 2026