RACONTEURPH
Stories worth sharing
Cybercriminals Persist in Breaking Passwords of Businesses in SEA
POSTED BY: Lionell Go Macahilig2024-05-07 16:22:04 PHT
Global cybersecurity company Kaspersky reports blocking more than 61M Bruteforce attacks eyeing businesses in Southeast Asia (SEA) last year.
From the period of January to December 2023, a total of 61,374,948 Bruteforce.Generic.RDP.* were detected and foiled by Kaspersky B2B products installed in companies of various sizes in the region.
A Bruteforce attack is a method for guessing a password or an encryption key that involves systematically trying all possible combinations of characters until a correct one is found. A successful Bruteforce attack allows an attacker to obtain valid user credentials.
Remote Desktop Protocol (RDP) is Microsoft’s proprietary protocol, providing a user with a graphical interface to connect to another computer through a network. RDP is widely used by both system administrators and less-technical users to control servers and other PCs remotely.
A Bruteforce.Generic.RDP.* attack attempts to find a valid RDP login / password pair by systematically checking all possible passwords until the correct one is found.
A successful Bruteforce.Generic.RDP.* attack allows an attacker to gain remote access to the targeted host computer.
Vietnam, Indonesia, and Thailand registered the highest number of RDP attacks last year. Meanwhile, Singapore has over six million incidents, the Philippines has almost 5 million, and Malaysia with the lowest number of nearly three million Bruteforce attempts.
| Countries | 2023 |
| Indonesia | 11,703,925 |
| Malaysia | 2,810,648 |
| Philippines | 4,620,264 |
| Singapore | 6,059,867 |
| Thailand | 10,205,819 |
| Vietnam | 25,974,425 |
| Grand Total | 61,374,948 |
“Bruteforce attack is not a threat companies should ignore. The use of third-party services for data exchange, employees working on home computers, and potentially insecure Wi-Fi networks, and the use of remote-access tools like RDP remain to be a headache for corporate infosec teams,” explains Adrian Hia, Managing Director for Asia Pacific at Kaspersky.
“We cannot discount that artificial intelligence modules and algorithms can be used to break corporate log-in and password pairs faster. And once threat actors gain remote access to your corporate computers, the possibility of financial and even reputational damage they can do becomes endless. Businesses here should beef up their endpoint and network security posture to defend themselves against smarter AI-based Bruteforce attacks,” he adds.
If you use RDP in your work, be sure to take all possible protection measures:
- At the very least, use strong passwords.
- Make RDP available only through a corporate VPN.
- Use Network Level Authentication (NLA).
- If possible, enable two-factor authentication.
- If you don’t use RDP, disable it and close port 3389.
- Use a reliable security solution like Kaspersky Endpoint Security for Business.
Companies are also encouraged to take a step further when it comes to defending their security perimeters. Kaspersky has an integrated software solution that includes a set of functions for event monitoring and management, Kaspersky Unified Monitoring and Analysis Platform (KUMA).
A unified console for monitoring and analysing information security incidents, KUMA can be used as a log management system and as a full-fledged SIEM system.
More information about the platform is available here: https://support.kaspersky.com/help/KUMA/1.5/en-US/217694.htm.
To know more the latest threat reports from Kaspersky, visit Securelist.com.
