Researchers are warning about a large-scale credential brute-forcing campaign targeting VPN and SSH services on Cisco, CheckPoint, Fortinet, SonicWall, and Ubiquiti devices around the world.
 

According to a report by Cisco Talos, the campaign, which began on March 18, uses a mix of valid and generic employee usernames related to specific organizations. The attacks originate from TOR exit nodes and various other anonymization tools and proxies, helping the threat actors evade blocks.
 

“Depending on the target environment, successful attacks of this type may lead to unauthorized network access, account lockouts, or denial-of-service conditions,” Cisco warned. “The traffic related to these attacks has increased with time and is likely to continue to rise.”
 

The following services are actively targeted by this campaign:

• Cisco Secure Firewall VPN

• Checkpoint VPN

• Fortinet VPN

• SonicWall VPN

• RD Web Services

• Miktrotik

• Draytek

• Ubiquiti
   

The researchers shared a complete list of indicators of compromise (IOCs) for this activity to aid organizations in mitigating attacks.