RedVDS - Brute-Force Activity from Bulletproof VDI (T1110)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•12

Detects brute-force tools (Hydra, NLBrute) originating from known RedVDS infrastructure IP ranges/ASNs, indicating cybercriminal VDI abuse.