SANS ISC: Brute Force Attacks Against Watchguard VPN Endpoints
npub1xk3jc3vcc4fw8gy6p0tnz2eegwh4jkmhjra8zt7nq9gnnnj4v9zq3dvxw8 (npub1xk3…vxw8) of SANS ISC identified 185.122.204[.]102 attempting to brute force a Watchguard firewall VPN. Curiously only using two usernames: jason and robert.
#IOC #threatintel
Not Simon the Goat /
npub1ce…mclln
2024-06-05 16:08:02
Author Public Key
npub1cetfz9z5qtn3lly58p3t4hmxxqhy0vml22z5g8rve3vjesg5gzxs6mcllnSeen on
wss://relay.nostr.bandPublished at
2024-06-05 16:08:02Event JSON
{
"id": "1c315790135dfded8be21624752f9d125ce96958bcec268fbe37a5eb825c1ad0",
"pubkey": "c65691145402e71ffc943862badf66302e47b37f5285441c6ccc592cc114408d",
"created_at": 1717603682,
"kind": 1,
"tags": [
[
"p",
"35a32c4598c552e3a09a0bd7312b3943af595b7790fa712fd3015139ce556144",
"wss://relay.mostr.pub"
],
[
"p",
"e77e9c8f3f269f4c83b0a98228e061af1bd45708c9f0fa88cb89a636981e8860",
"wss://relay.mostr.pub"
],
[
"t",
"ioc"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/users/screaminggoat/statuses/112564874951834587",
"activitypub"
]
],
"content": "SANS ISC: Brute Force Attacks Against Watchguard VPN Endpoints\nnostr:npub1xk3jc3vcc4fw8gy6p0tnz2eegwh4jkmhjra8zt7nq9gnnnj4v9zq3dvxw8 of SANS ISC identified 185.122.204[.]102 attempting to brute force a Watchguard firewall VPN. Curiously only using two usernames: jason and robert.\n\n#IOC #threatintel",
"sig": "b1874b71bc6bebc900824443ff6bf16f57aaba87e35496f4f092eea4d1b786460796d9cfa1f8571f2b11175e10bb9c3e6c63d8bdcea0fb609e05e4d2c2dba3bd"
}