LockoutMalware
ransomwareFrom MISP Galaxy
Last reported 16 days ago, by Infosecurity Magazine2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1110Brute Force
“Researchers Spot Surge in Brute-Force Attacks from Middle East”
- T1110.003Password Spraying
“Hackers use automated tools to scan for exposed FortiGate SSL VPN portals, and then employ credential stuffing and password spraying techniques based on prior Fortinet leak dumps and infostealer logs to gain access.”
- T1110.004Credential Stuffing
“Hackers use automated tools to scan for exposed FortiGate SSL VPN portals, and then employ credential stuffing and password spraying techniques based on prior Fortinet leak dumps and infostealer logs to gain access.”
- T1556.009Conditional Access Policies
“… auth flow mints a new user-delegated token, allowing the attacker to completely bypass multi-factor authentication (MFA) and Conditional Access Policies (CAP).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
FBI and Secret Service Warn of FortiBleed Lockout Threat“FBI and Secret Service Warn of FortiBleed Lockout Threat”
-
How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant“…WS/Azure addresses, threat actors can "bring" their own block and rotate to new IPs after each login attempt to evade Microsoft's Smart Lockout or other detection methods.”
Thanks — we review every report.