Password Spraying Activity Targeting Various VPN Appliances, Firewalls, and Other Public Web-Based Applications

**Executive summary:** Arctic Wolf observed an active password-spraying campaign since 28 February 2024 targeting web-based authentication on VPNs and firewall appliances across multiple vendors; while no successful intrusions have been confirmed, the report recommends mitigations including enforcing MFA, blocking or classifying hosting-provider traffic, enabling automated throttling/connection blocking for mass authentication attempts, forwarding VPN/firewall logs to monitoring, and geolocation-based restrictions.