SSH brute force surges tied to world events, honeypot data shows

This guest diary by Adam Nason examines SSH brute force attack behaviors over three months, analyzing over 20 million attempts logged by a DShield Honeypot. The study correlates these attacks with significant cyber events and geopolitical tensions, identifying patterns indicative of coordinated botnet activities. Key findings include sudden surges in attack volumes aligned with major advisories and conflicts, revealing a potential link between external events and malicious activities.

The analysis also highlights the importance of reducing the attack surface through strategies such as disabling root logins, enforcing multi-factor authentication, and using private keys. Overall, it emphasizes the need for heightened awareness and basic security measures to mitigate such persistent threats.