Vietnam hit hardest by brute-force cyberattacks in Southeast Asia
Vietnam recorded nearly 20 million brute-force cyberattacks in 2024, or 37% of all such incidents in Southeast Asia.
Brute-force remains a primary method for cybercriminals infiltrating businesses in the region, according to cybersecurity firm Kaspersky. Its systems alone detected and blocked over 53 million attempts across the region last year.
This attack method uses an automated trial-and-error technique, where hackers systematically test password combinations until they gain unauthorized access. While straightforward, brute-force attacks can be highly effective when systems lack protections such as login attempt limits or two-factor authentication.
Cybercriminals often combine brute-force attacks with Microsoft’s remote desktop protocol (RDP), a tool commonly used by system administrators and non-experts to remotely control servers and computers. RDP serves as a key entry point for hackers targeting critical enterprise resources, Kaspersky said.
While the number of brute-force attacks also surged in Indonesia and Malaysia, Vietnam faced the brunt. Indonesia experienced 14.66 million RDP-targeted assaults, a 25% increase from 2023, while Malaysia saw 3.2 million attacks, up 14%.
Adrian Hia, Kaspersky managing director for Asia-Pacific, said his firm recorded more than 145,000 brute-force attack attempts daily on businesses in Southeast Asia, a concerning figure given the region’s shortage of cybersecurity professionals. He also raised an alarm about the growing threat of combining brute-force attacks with artificial intelligence.
Kaspersky’s 2024 report said AI could crack 61% of passwords within 60 seconds, and 17% within one to 60 minutes. Cybercriminals are using AI to accelerate password cracking and bypass encryption, allowing them to remotely access corporate systems once inside, which poses significant risks, Hia said.
He also warned of the consequences of a digital spy operating silently within a company’s network.
To mitigate these risks, he said businesses and individuals should audit their cybersecurity practices, disable RDP when unnecessary and implement stronger security measures. Another strategy is using strong, unique passwords, multi-layered security, or passwordless authentication, he added.
By Luu Qy – VnExpress.net – May 19, 2025