🎯 MITRE ATT&CK

T1110 Brute Force
T1078 Valid Accounts

👤 Who

An external IP address 37.19.221.229 attempted multiple VPN logins against user accounts including [email protected], [email protected], [email protected] and [email protected]

🔎 What

Multiple failed VPN authentication attempts were detected from the same source IP, followed by a successful login to [email protected]. The activity indicates a brute force attempt that resulted in valid account access.

🕐 When

Jun 21, 2023, 01:51 PM

📍 Where

Source IP: 37.19.221.229
Destination: vpn-letsdefend.io (Host: Mane)

💡 Why

Authentication logs show repeated failed login attempts against multiple usernames from the same IP address, followed by a successful login shortly after. This pattern is consistent with brute force or credential stuffing activity leading to account compromise.

📋 Response

The affected account and associated host were isolated and contained.

---

If you made it this far and you speak a little hex… 0x74617465.sh