Over the last month, Agio’s cybersecurity monitoring systems have detected a significant rise in sophisticated brute force attacks targeting publicly accessible virtual private networks (VPNs). What began as an isolated incident quickly revealed a broader pattern in the attack targeting firms with similar VPN configurations.  This proactive investigation—checking all client environments after detecting an issue in one—exemplifies Agio’s approach to cybersecurity. 

Our comprehensive analysis uncovered that these attacks represent a concerning evolution in threat actors’ tactics, specifically targeting organizations’ remote access infrastructure. The data reveals not just an increase in attack volume, but also more distributed attack patterns that bypass traditional security controls. 

What We’ve Observed 

Our security operations center (SOC) has observed several key trends in these attacks: 

  • High attack volumes, averaging around 200 login failure attempts per minute. 
  • Sophisticated IP distribution patterns suggesting the use of substantial botnets. 
  • Adaptive attack strategies that adjust to evade security controls. 
  • Initial probing activities followed by coordinated, distributed attacks.

While we continue to analyze the full scope of this threat, preliminary data suggests these attacks are part of a broader campaign targeting organizations across multiple sectors. The sophisticated nature of these attacks indicates they may be orchestrated by well-resourced threat actors. 

Emerging Attack Patterns 

What makes these attacks particularly concerning is the execution. Our security team has identified several distinct patterns that set these attacks apart from typical brute force attempts: 

  • Geographic Distribution: The attacks originate from a diverse range of IP addresses worldwide, with a significant portion coming from within the United States. This makes traditional geo-blocking strategies less effective as a primary defense mechanism. Our data shows that initial probing activities often originate from Russia-based IPs before transitioning to a globally distributed attack pattern. 
  • Adaptive Attack Rates: The attackers demonstrate an advanced understanding of common security controls. When rate-limiting measures are implemented, the attacker adjusts their attack patterns to maintain persistence while staying below detection thresholds. This adaptive behavior makes traditional rate-limiting less effective and requires more advanced detection methods. 
  • Coordinated Botnet Activity: The attack traffic shows signs of sophisticated botnet orchestration. Login attempts are evenly distributed across numerous IP addresses, making it difficult to implement effective IP-based blocking without potentially impacting legitimate users. This distribution pattern suggests the use of a well-maintained botnet infrastructure. 

These complex execution methods call for even more robust mitigation strategies. 

Effective Mitigation Strategies 

At Agio, notifying you of an alert is only the beginning. After detecting this attack, our Cyber Operations and Network Support teams worked together to create a set of mitigation strategies against the attacker’s techniques.  We recommend a multi-layered approach to protection: 

  • Infrastructure Hardening 
  • Disable web-based VPN login pages where possible.  
  • Implement certificate-based authentication instead of traditional username/password mechanisms. 
  • Block direct IP access to VPN endpoints. 
  • Modify VPN access URLs to use non-standard paths (e.g., vpn.company.com/remoteaccess). 
  • Authentication Controls 
  • Deploy multi-factor authentication (MFA) across all VPN access points. 
  • Implement adaptive authentication that considers user behavior and location. 
  • Regular rotation of access credentials and certificates. 
  • Monitoring and Response 
  • Implement continuous monitoring of VPN access attempts. 
  • Deploy automated response capabilities to block suspicious IP addresses. 
  • Regular review and updating of security controls based on emerging threat patterns.

See also  If You’re Thinking “A Cyber Attack Won’t Happen to Me,” Think Again

Don’t Go It Alone 

It’s worth noting that if you’re currently a Cybersecurity Operations client of ours, your services already include 24/7 monitoring and real-time threat mitigation that proactively protect your firm from these types of threats and our team is actively monitoring and implementing controls to mitigate them.  

As new and rising threats become apparent, we’re also consistently updating our Knowledge Center within the AgioNow Portal to keep you informed, ensuring your organization stays ahead of emerging threats.  

Screenshot of customer portalIf you’d like to learn more or have a deeper conversation around Cyber Operations, connect with us as the first step in protecting your firm.