How do you protect a door when the locks are invisible? In June and July 2025 thousands of internet‑connected remote access systems were hammered by a relentless torrent of login attempts that left administrators scrambling. The bulk of that traffic targeted two familiar remote work technologies: SSL VPN gateways and Microsoft’s Remote Desktop Protocol (RDP). The lesson is blunt: exposed authentication endpoints and weak credentials are an open invitation for adversaries.
SSL VPN and RDP were primary targets
French cybersecurity firm Intrinsec traced the campaign to an Ukraine‑based autonomous system labeled FDN3 (AS211736). Researchers described the activity as “massive brute‑force and password spraying campaigns” aimed primarily at SSL VPN appliances and RDP hosts. The scale and pattern of the activity point to a credential‑testing operation rather than casual scanning: automated, high‑volume logon attempts concentrated on publicly reachable remote access services.
SSL VPNs provide encrypted tunnels that let employees reach internal applications via a browser or client, while RDP enables remote control of Windows machines. Both expose authentication endpoints to the internet, making them natural targets for attackers who rely on brute force—rapid, repeated password guesses—or password spraying, where common passwords are tried across many accounts to avoid triggering lockouts. The FDN3 campaign stands out not only for volume but for intent: systematic attempts across many IPs suggest operators seeking usable credentials for resale, a commercial testing service, or a platform for later intrusion.
Successful compromise of an SSL VPN or RDP host is often a gateway to more serious activity: installing persistence mechanisms, moving laterally through a network, exfiltrating data, or deploying ransomware. For organizations that depend on these services to enable telework or remote administration, the fallout can mean costly downtime, expensive remediation, reputational damage, and regulatory consequences.
Tactics observed in the credential‑testing campaign
– High frequency of automated login attempts focused on authentication endpoints rather than indiscriminate port scans.
– Credential stuffing and password spraying consistent with account takeover pipelines.
– Use of regionally hosted infrastructure intended to blend into background noise and complicate attribution.
Intrinsec’s assessment stops short of asserting state involvement. Hosting in a particular country’s AS space does not prove political motive; cybercriminals commonly rent or compromise infrastructure across jurisdictions to obscure their activity. The behavioral indicators point to criminal tradecraft focused on monetizing access rather than geopolitical objectives.
Practical defenses for SSL VPN and RDP administrators
– Enforce multifactor authentication (MFA) on SSL VPNs and RDP gateways. MFA remains the single most effective barrier to credential abuse.
– Rate‑limit authentication attempts and monitor for spikes in failed logins. Implement account lockouts or progressive backoff to slow automated attacks.
– Put RDP behind a hardened jump host or require VPN access that enforces strong authentication and granular access controls.
– Segment networks so that compromised remote endpoints do not grant unfettered lateral movement. Apply least‑privilege principles to remote accounts.
– Maintain robust logging and alerting for authentication anomalies; centralize logs in a SIEM or managed detection service to spot patterns early.
– Disable or restrict unused remote access services and routinely audit public endpoints to reduce the attack surface.
These measures are practical and often inexpensive relative to the potential cost of a breach. Even smaller organizations can make meaningful gains: roll out simple MFA, use cloud‑based managed detection services, and apply password managers to ensure unique, strong credentials.
Guidance for smaller organizations and end users
Smaller teams frequently lack dedicated security staff, but they can still significantly reduce risk:
– Audit remote access services and close or restrict any that aren’t required.
– Rotate credentials and use password managers to create and store unique, complex passwords.
– Deploy MFA for all remote access points and consider cloud‑based authentication services if on‑premise options are too complex.
– Subscribe to threat intelligence feeds or managed services that can surface targeted brute‑force activity early.
Those steps yield a high security return on investment and dramatically reduce the chance that automated credential testing will succeed.
Policy and infrastructure implications
Large‑scale credential testing hosted regionally raises hard questions for ISPs, regulators, and international law enforcement. Identifying an autonomous system as a source of abuse puts pressure on infrastructure providers to police malicious traffic, but it also raises due‑process and operational concerns about disrupting legitimate services. Better cross‑border cooperation and incentives for ISPs to act on abuse reports without harming benign customers will be essential. Vendors and managed service providers also have a role: ship secure defaults and make hardening straightforward to reduce exploitable misconfigurations.
A systemic problem: insecure defaults and complacency
Reports like Intrinsec’s are valuable because they compress the time between discovery and remediation—and expose a systemic weakness. Too many internet‑exposed services remain configured with weak protections or default settings. Vendors can reduce the attack surface by shipping secure defaults and clearer hardening guidance; enterprises must stop treating remote access as an afterthought and instead bake credential hygiene and access control into everyday operations.
Conclusion: treat SSL VPN security as mission‑critical
The FDN3 campaign is a reminder that attackers are methodical and economical: they will repeatedly test low‑effort avenues until they find success. SSL VPN and RDP endpoints are high‑value targets because a single compromised credential can unlock broad access. The simplest defenses—MFA, network segmentation, rate limiting, strong password policies, and vigilant logging—remain the most effective. Organizations that act now to harden their SSL VPN deployments and related remote access infrastructure will drastically reduce their exposure and make credential testing campaigns far less profitable. How many more attacks are quietly probing default settings and weak passwords? That depends on whether defenders treat remote access security as an operational priority or a checkbox.
