It was a typical morning at Cowabunga Computers. Our team arrived at the office, ready to tackle the day’s tasks, when a critical alert from our Remote Monitoring and Management (RMM) tool caught our attention. Five user accounts at one of our client’s sites were reported as locked out. The affected users were Brian, Joseph, Jared, Mary, and Jacob. Our team knew that something was amiss, and quick action was necessary.

The Unexpected Alert

The alert stemmed from a security policy we had set up to monitor user accounts. It flagged that these accounts were locked out due to repeated failed login attempts. Immediately, our team dove into the logs and details of the alert. We discovered that the attempts were coming from a specific IP address, and the user accounts were under attack.

Digging Deeper

Further investigation led us to the IIS logs on the client’s server. The logs revealed a troubling pattern: someone was systematically trying to brute force their way into the system. The attacker was targeting the Remote Desktop Web Access (RDWeb) login pages, attempting to break through our defenses. Despite these efforts, none of the passwords were successful, thanks to the added layer of security provided by Duo 2FA. However, the repeated attempts were enough to lock out the accounts, disrupting the users’ access.

Swift Response

Recognizing the urgency of the situation, our team quickly mobilized. First, we unlocked the affected accounts, restoring access to Brian, Ryan, Paul, Nikki, and Sarah. Then, we turned our attention to stopping the attacker.

We identified the attacker’s IP address and immediately added it to our firewall blocklist. Not stopping there, we blocked the entire subnet to ensure no further attempts could be made from that range. A reverse GeoIP lookup revealed that the attacker was operating from the Netherlands. To bolster our defenses, we blocked access from the entire country.

Securing the Fort

To further secure the server, we made a critical configuration change. We removed the wildcard binding on the IIS server, ensuring that it would only serve login pages if the domain name was known. This move added another layer of protection, making it harder for attackers to find their way in.

The Aftermath

Thanks to our quick response and proactive measures, we were able to thwart the attack and restore normal operations swiftly. But this incident served as a stark reminder of the potential dangers lurking in the digital world. A brute force attack like this, if left unchecked, could have led to compromised accounts, data breaches, and significant operational disruptions.

Lessons Learned

Our team at Cowabunga Computers took this incident as an opportunity to strengthen our defenses and refine our procedures. We enhanced our monitoring systems, updated our security protocols, and conducted additional training for our staff and clients on recognizing and responding to security threats.

A Call to Action

For businesses, incidents like these underscore the importance of having a vigilant and responsive IT partner. Missing an incident like this could lead to severe consequences, but with the right measures and a proactive approach, the risks can be mitigated effectively.

At Cowabunga Computers, we are committed to protecting our clients from cyber threats and ensuring their operations run smoothly. Our swift action in this incident highlights our dedication to providing top-notch security and support. Let us help you secure your business and navigate the ever-evolving landscape of cybersecurity threats.