Dragos identified malicious brute‑force activity targeting VPN appliances across multiple critical infrastructure sectors in North America, including electric, oil and gas, water and wastewater, and manufacturing. The behavior indicates early‑stage reconnaissance aimed at gaining initial access to Cisco SSL VPNs. Attackers used broad scanning, credential‑stuffing attempts, and distributed infrastructure to probe victims. The activity poses risks to OT networks if attackers pivot from compromised IT systems. Dragos recommends immediate mitigations, including enforcing MFA, tightening access controls, monitoring for unusual authentication attempts, and applying critical controls to reduce exposure.

Join for free to read