Massive brute force attack uses 2.8 million IPs to target VPN devices

A sustained, large-scale brute-force credential campaign is ongoing that uses roughly 2.8 million daily source IPs—likely botnets or residential proxy networks—to attempt logins against internet-exposed edge/security appliances (firewalls, VPNs, gateways) across many vendors and geographies; monitoring by Shadowserver shows widespread distribution and high scale, and the report recommends stronger passwords, MFA, allowlists, disabling web admin interfaces, and timely firmware updates.