Threats · 175 days ago
Edge VPN appliances are being treated as credential gates, not just perimeter gear. A brute-force surge against SonicWall MySonicWall and Fortinet FortiGate means exposed or weak logins can turn into initial access at scale, and the usual assumption that these devices are only hardened by being on the edge misses the point.
Barracuda says nearly 90% of the Q1 activity it tracked came from Middle East IP space, and the attacks made up more than half of its observed threat activity between February and March. The report points to a mix of state-linked, professional, and opportunistic groups, with the timing overlapping heightened regional tension and increased Iran-nexus activity.
The practical risk is persistent credential pressure on perimeter devices that often sit outside normal identity controls. Even without a confirmed single actor, the concentration and target set suggest coordinated access-seeking against high-value network entry points.
2 sources covering this story
Researchers Spot Surge in Brute-Force Attacks from Middle East
Barracuda says 88% of brute-force attempts in Q1 were from the region
Brute-force cyberattacks originating in Middle East surge in Q1
Hackers have primarily targeted SonicWall and Fortinet devices, according to researchers.
Part of the PlainSec briefing for 2026-04-15