Security researchers have uncovered a sophisticated brute-forcing framework called “BRUTED” developed by the Black Basta ransomware operation. This automated tool, operational since 2023, enables attackers to breach edge networking devices including firewalls and VPNs at scale.
## How BRUTED Works
EclecticIQ researcher Arda Büyükkaya discovered the framework after analyzing leaked internal chat logs from the ransomware gang. BRUTED specifically targets seven major VPN and remote-access products:
– SonicWall NetExtender
– Palo Alto GlobalProtect
– Cisco AnyConnect
– Fortinet SSL VPN
– Citrix NetScaler (Citrix Gateway)
– Microsoft RDWeb
– WatchGuard SSL VPN
The framework operates by:
1. Searching for publicly accessible devices by enumerating subdomains
2. Resolving IP addresses and appending prefixes like ‘.vpn’ or ‘remote’
3. Retrieving password candidates from remote servers
4. Combining them with locally generated guesses
5. Executing multiple authentication requests via parallel CPU processes
To enhance password guessing, BRUTED extracts Common Name (CN) and Subject Alternative Names (SAN) from SSL certificates, generating additional password combinations based on the target’s domain and naming conventions.
## Evasion Techniques
The framework employs SOCKS5 proxies to hide the attacker’s infrastructure. Its main servers are located in Russia and registered under Proton66 (AS 198953). Leaked chat logs revealed operational challenges including server downtime due to unpaid fees, providing insight into the ransomware gang’s day-to-day operations.
## Defensive Measures
Organizations can protect against BRUTED attacks by:
– Enforcing strong, unique passwords for all edge devices and VPN accounts
– Implementing multi-factor authentication (MFA)
– Monitoring for authentication attempts from unknown locations
– Tracking high-volume login failures
– Implementing rate-limiting and account lockout policies
– Blocking requests from known malicious infrastructure using EclecticIQ’s shared list of IPs and domains
– Keeping edge devices updated with the latest security patches
While BRUTED doesn’t exploit vulnerabilities directly, it streamlines ransomware operations by enabling threat actors to breach multiple networks simultaneously with minimal effort, significantly increasing their potential for monetization.