Password Spraying Activity Targeting Various VPN Appliances, Firewalls, and Other Public Web-Based Applications

Arctic Wolf observed a password spraying campaign beginning 28 Feb 2024 targeting web-based authentication on multiple VPN and firewall vendors; activity involves numerous authentication attempts using random usernames, with no confirmed successful intrusions so far. The advisory recommends implementing MFA, blocking or classifying hosting-provider traffic, enabling automated login throttling/connection blocking, forwarding VPN/firewall logs to Arctic Wolf, and considering geolocation-based restrictions to reduce risk.