Cisco Warns of Massive Surge in Password-Spraying Attacks on VPNs

Cisco Talos warned of a rapid surge in brute-force/password‑spraying attacks beginning around March 28 that indiscriminately target VPNs (including Cisco Secure Firewall and products from Checkpoint, Fortinet, SonicWall, Mikrotik, Draytek), SSH, and web authentication interfaces; attackers are using common usernames/passwords and proxy services (Tor, Nexus Proxy, Space Proxies, BigMama), and Cisco published IOCs and mitigation recommendations including logging, hardening VPN profiles, and blocking malicious sources.