BlackSuit VPN brute-force burst with tight success correlation

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•1

Detects successful VPN logins following a burst of failed attempts from multiple IP addresses, where the successful login originates from a known malicious IP or an IP associated with the preceding failed attempts. This rule specifically identifies potential credential stuffing or password spraying activity targeting VPN services, often associated with the BlackSuit ransomware group.