Ukrainian Network FDN3 Launches Massive Brute-Force Attacks on SSL VPN and RDP Devices

Cybersecurity researchers have flagged a Ukraine-based IP network, FDN3, for engaging in massive brute-force and password spraying campaigns targeting SSL VPN and RDP devices between June and July 2025. The activity originated from AS211736, the Ukraine-based autonomous system associated with FDN3, according to Intrinsec.

They note that FDN3 is likely part of a wider abusive infrastructure that includes VAIZ-AS (AS61432) and ERISHENNYA-ASN (AS210950), with a Seychelles-based system named TK-NET (AS210848) also involved, as per Intrinsec’s report published last week. Intrinsec states that these networks were created in August 2021 and frequently exchange IPv4 prefixes to evade blocklists and continue hosting abusive activities.

One prefix range linked to FDN3—88.210.63[.]0/24—has been associated with large-scale brute-force and password spraying activity, which scaled to a peak between 6 and 8 July 2025. The brute-force and password spraying efforts targeted at SSL VPN and RDP assets could last up to three days, according to Intrinsec, and some of these techniques have been used by ransomware‑as‑a‑service groups as initial access vectors.