Threat Update: Brute Force Attacks

ZeroFOX Alpha Team has observed a spike in brute force attacks against our honeypots. Brute force attacks target user accounts, services, or devices and make multiple log-in requests in the hopes of finding a set of successful credentials. This advisory covers a brief overview of brute force attacks, and trends we’ve observed in our honeypots.

Recommendations

Never reuse passwords between accounts
Ensure that your organization is not unnecessarily exposing services to the internet, as these services could potentially be targeted in brute force attacks

Details

Brute force attacks describe any tactic that involves an attacker attempting to login to an account, or internet-facing device or service, with a list of potential passwords. These password lists may be random, or they may be built from the data breach databases that are bought and sold on the deep/dark web. Often, attackers will build password lists by combining the passwords of multiple breaches. Password lists of this nature are particularly dangerous to users who re-use passwords between accounts, were the list to be used in a brute force attack against the account.

Brute force attacks can also be used against services and devices that face the internet. Login attempts may target ssh, for example, in an attempt to connect to a device. Alternatively, routers and other network infrastructure may also be targeted. These attacks could be particularly fruitful because some of these devices may use hardcoded passwords for their administrative accounts.

After successfully gaining access to their target, attackers may exploit their victims in a number of ways. Compromised account credentials may be sold on criminal forums, used to drain financial accounts, or used to pivot into other high-value accounts. For example, a compromised email account may be used to reset the passwords of other associated accounts, allowing the attacker access to those accounts. Compromised services/devices could be used to infiltrate an organization’s network and gain access to sensitive information, ultimately resulting in a data breach.

This week, the ZeroFOX Alpha Team observed a spike in brute force attacks targeting our honeypots. Alpha Team enlists a network of honeypots in order to gain insight into attack vector trends. Our honeypots consist of multiple different deliberately vulnerable services in the hopes of luring attackers into targeting them. The most commonly-tried passwords in these attacks are shown in the wordcloud below.

Figure 1. Commonly-tried passwords in this week’s bruteforce attempts

The most commonly-tried usernames were:

root
support
admin
sh

These attacks come from a variety of sources, with the majority of requests coming from IP addresses in Moldova. ZeroFOX recommends blacklisting the list of top-ten known-attacker IPs, below.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/121/list_indicators/

IOCs

185.153.199.51
45.143.220.4
119.42.99.35
196.2.9.16
27.254.108.33
45.141.87.10
185.202.2.238
195.154.45.194
66.186.160.54
141.98.81.150