Password Spraying Activity

Arctic Wolf observed an ongoing password-spraying campaign starting 28 Feb 2024 that targets web-based authentication on VPNs and firewalls across multiple vendors (including Cisco, Palo Alto Networks, and WatchGuard). The activity involves high-volume automated login attempts using random or non-existent usernames; no confirmed successful compromises have been seen. Arctic Wolf recommends implementing MFA, blocking or classifying hosting-provider traffic, enabling automated login blocking/throttling, forwarding VPN/firewall logs to MDR, and considering geolocation blocks to reduce exposure.