Cryptotrojans (like Emotet) have been all over the news recently. After all, these forms of malware cause a lot of damage. But it doesn’t always have to be malware that threatens your IT infrastructure and your data. For example, brute force attacks are still a popular method used by cyber criminals to gain access to a company network. In a brute force attack, hackers try to crack passwords by using software that tries different character combinations in quick succession. Although this is usually a simple algorithm, modern high-performance computers can enter up to 2 trillion possible passwords per second until the right one is found. The greatest risk comes from overly short and simple passwords, and passwords that are used for multiple purposes.

The extent of the risk that this kind of attacks imply can be seen in the case of a leak that happened at the beginning of this year. In mid-January, cybercriminals published the access data and IP addresses of more than 515,000 servers, routers and IoT devices on a well-known hacker forum. With this data it is possible to remotely control vulnerable devices via the Remote Maintenance service Telnet. According to their own statements on the forum, hackers automatically scanned the Internet for devices with open Telnet access. Factory-set default passwords and easily guessed combinations were then tried out. This was done with alarming success, as can be seen from the very extensive list of access data that has been published.

As soon as an attacker accesses one or more endpoints within a company network using the information on this list, they have access to a wide range of possibilities to harm that company. While common IT security solutions should ideally alert you as soon as malware is installed, this does not always happen. For example, when legitimate—meaning not classified as malicious—programs are launched to gain access to further access data in a malwareless attack.

Which IT security strategy protects your business?

In our infosheet “Adaptive Defense at work…” we show you what such an attack scenario could look like, and how Panda Adaptive Defense 360 detects this malwareless attack, unlike classic IT security solutions. In addition, we explain how to protect compromised endpoints within the network that depend on other security solutions.

Further information on our progressive technology can be found here. Do you have any questions? As a CISO or IT company manager, please contact a Panda Security contact directly. Are you an IT service provider? Then we would like to invite you to one of our Technology Days in your area. Here you will get a comprehensive overview of Panda Security’s technologies, features and Unique Selling Points.