InfoSecBulletin Cybersecurity for mankind
The Shadowserver Foundation reports that a brute force attack has been active since last month, using nearly 2.8 million IP addresses each day attempting to guess the credentials for a wide range of networking devices.
A brute force attack occurs when attackers repeatedly try different usernames and passwords to access an account or device until they find the right combination. Once they gain access, they can hijack the device or network.
CVE-2024-55591 and CVE-2025-24472
New SuperBlack ransomware exploits Fortinet flaws
CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws
CVE-2025-20138
Cisco released High Security Alert for IOS XR Software
400+ IPs Exploiting Multiple SSRF Vulnerabilities
NVIDIA has released update for NVIDIA Riva
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV
The majority of the 1.1 million participants come from Brazil, followed by Turkey, Russia, Argentina, Morocco, and Mexico with many other as source of origin.
These are security devices like firewalls, VPNs, and gateways that are often connected to the internet for remote access.
The attacks mostly involve compromised MikroTik, Huawei, Cisco, Boa, and ZTE routers and IoT devices, often controlled by large malware botnets.
BleepingComputer reports that the Shadowserver Foundation has confirmed that this activity has been ongoing for some time but has recently intensified significantly.
ShadowServer reported that the attacking IP addresses come from various networks and Autonomous Systems, suggesting they may be part of a botnet or linked to residential proxy networks.
To protect edge devices from brute-force attacks, change the default admin password to a strong, unique one, enable multi-factor authentication (MFA), use an allowlist of trusted IPs, and disable unnecessary web admin interfaces.
U.K. orders Apple to let it spy on users’ encrypted accounts: Report
