Moroccan hackers involved in a massive cyberattack

The hackers are using automated programs to test several combinations of usernames and passwords in order to hack into perimeter security devices (Firewall or Virtual Private Network – VPN). Involved in the operation are 2.8 million IP addresses, most of them originating from Morocco, Turkey, Russia, Argentina and Mexico, says The Shadowserver Foundation, an association specializing in the fight against cybercrime.

The association says it has noted in recent weeks a “sharp increase in brute-force Web login attacks against perimeter devices.” The attackers are primarily targeting network devices from Palo Alto Networks, Ivanti and SonicWall, reports 01.net, specifying that these hackers are exploiting security vulnerabilities in outdated or end-of-life routers to carry out their attacks.

Also read: Morocco behind a cyberattack against the Algerian football federation?

To succeed in their operation, they use residential proxy networks, an IP address associated with a genuine user of an Internet service provider, which makes them impossible to detect. This massive attack against network devices is not new. Last April, Cisco warned of these brute-force attacks targeting Cisco, CheckPoint, Fortinet, SonicWall and Ubiquiti devices around the world.

To prevent these attacks, it is advisable to use a password that is difficult to guess. Users are also advised to enable two-factor authentication and restrict connections by allowing only certain known IP addresses, without forgetting to install all available updates on their computer.