Anatomy of an Attack: New Report Exposes Ukrainian Networks Fueling Global Brute-Force Campaigns

According to Intrinsec, a new report reveals a sprawling web of Ukrainian and offshore networks fuelling large-scale brute force and password spraying campaigns, enabling persistent cyberattacks and ransomware operations. Between June and July 2025, the Ukraine-based autonomous system FDN3 (AS211736) was observed launching multiple hundreds of thousands of brute force and password spraying attacks against SSL VPN and RDP devices over up to three days.

The analysis ties FDN3 to a broader ecosystem including VAIZ-AS (AS61432), ERISHENNYA-ASN (AS210950), and the Seychelles-based TK-NET (AS210848), with August 2021 allocations showing these prefixes often exchange IPv4 routes to evade blocklisting. It notes a strong link to offshore bulletproof hosting, with IP Volume Inc. identified as a key transit provider, and indicates that rebranding or reallocation of prefixes can allow networks to continue abusive activities.

The report also points to ransomware groups such as GLOBAL GROUP and Black Basta relying on brute-forcing VPN appliances, and to Whois records tying FDN3’s maintenance to Alex Host LLC, a Russian-linked entity.