Edge Devices Face Surge in Mass Brute-Force Password Attacks

Honeypots designed to track malicious internet activity have detected a surge in attacks targeting edge devices, often being launched by other malware-infected edge devices.

See Also: From Silos to Synergy: Gen AI Aligns IT and Security Teams

The Shadowserver Foundation on Saturday warned that in the last few weeks its honeypots have revealed a “large increase in web login brute-forcing attacks.” These especially – but not exclusively – target devices manufactured by Palo Alto Networks, Ivanti and SonicWall, said the nonprofit security organization, which not only tracks malicious activity online, but often sinkholes malicious domains (see: Abandoned Backdoors: How Malicious Infrastructure Lives On).

Security experts continue to warn that edge devices remain a top initial-access vector for both criminal and nation-state hackers.

The Shadowserver Foundation said attackers recently have used as many as 2.8 million unique IP addresses per day to launch brute-force attacks against edge devices. Of those IP addresses, lately 1.1 million appear to be based in Brazil, followed by about 135,000 in Turkey, 133,000 in Russia and 99,000 in Argentina.

While the surge in these attacks is new, the attacks themselves remain long-running.

“These attacks – password login attempts against exposed edge devices – have been going on for a few years now, steadily intensifying over time,” but the recent spike is new, the organization told Information Security Media Group. “The amount of unique IPs involved is unprecedented and offers a glimpse into the scale of malware infections.”

The malware-infected equipment being used to launch these attacks on Saturday featured more than 100,000 MikroTik devices, as well as a lesser number of devices manufactured by the likes of Huawei, Cisco and Ubiquiti, or internet of things equipment running Allegro Software, among more than 200 other manufacturers or software stack developers, according to the honeypot detections.

The Shadowserver Foundation said it can’t always track a source IP to a specific device, and also that in some cases, the infected device may be behind the device it has identified.

So, what accounts for the incredibly large number of apparently infected MikroTik devices being used to launch brute-force password login attempts against internet-accessible routers, firewalls, virtual private network appliances and other edge hardware?

“We do not know,” The Shadowserver Foundation said, but the group noted that routers, switches and wireless systems built by Latvia-based MikroTik are popular in Brazil, and that the campaign could involve a mass compromise of those devices.

“It is possible also that the malware behind the attacks is bundled or a part of software popular in Brazil – for example, some VPN proxy software – but we do not know for sure, so this is just speculation,” the organization told ISMG.

Beyond brute-force password login attempts, researchers say edge device-targeting attackers will sometimes seek to exploit zero-day vulnerabilities in the equipment. But much more often, they target known vulnerabilities to take advantage of many firewalls, email gateways and VPN gateways and other edge equipment not getting patched in a timely manner, they say.

Notably, investigators probing the Chinese cyberespionage campaign tied to the group codenamed “Salt Typhoon,” that successfully infiltrated at least nine U.S. telecommunications giants and more abroad, said attackers sometimes appeared to gain initial access to victims’ environments by exploiting unpatched vulnerabilities in their edge devices. This reportedly included networking gear built by Cisco and Fortinet (see: China’s Hacking of US Telecoms: Officials Name More Victims).