Cisco Warns of Global Surge in Brute-Force Attacks Targeting VPN and SSH Services

Cisco Talos warns of a global surge in brute-force and password-spray attacks (since March 18, 2024) against VPNs, SSH and web authentication interfaces — activity largely routed through Tor exit nodes and various proxy services — while Fortinet reports exploitation of CVE-2023-1389 in TP-Link Archer AX21 routers to deliver multiple DDoS botnet families (AGoent, Condi, Gafgyt, Mirai, Miori, MooBot); organizations are advised to patch devices, monitor for proxy/Tor-sourced login attempts, and consult published IoCs.