Ukrainian Hackers Ramp Up Brute-Force and Password-Spraying Attacks on VPN and RDP Systems

In mid-2025, a coalition of Ukraine-based autonomous systems conducted unprecedented brute-force and password-spraying campaigns against exposed SSL VPN and Remote Desktop Protocol services, overwhelming security defences. Over a three-day window in July 2025, the network identified as AS211736 (“FDN3”) unleashed more than 1.3 million login attempts against corporate VPN and RDP endpoints.

Security researchers link these attacks to an interconnected cluster of Ukrainian autonomous systems that exchange prefixes with TK-NET in Seychelles to evade blocklists. The networks originated simultaneously in August 2021 and route through IP Volume Inc., a Seychelles-based front for a bulletproof hosting provider. On 6 July 2025, the FDN3 prefix 88.210.63[.]0/24 began firing waves of login attempts across thousands of VPN appliances and RDP servers, peaking at over 110 000 hits per individual IP address.

Honeypot telemetry shows a near-uniform distribution of attempts across SSL VPN ports (443 and 8443) and RDP (3389), indicating a broad probing strategy designed to maximise infiltration odds. The campaign aligns with patterns observed in RaaS-associated credential-stuffing and brute-force activity, underscoring the need for stringent rate-limiting, multi-factor authentication, and proactive blocklisting of abusive networks.