Global Brute-Force Campaign Prompts Accelerated Security Releases

An international cybersecurity advisory published today details an ongoing, widespread brute-force campaign targeting government and private-sector networks worldwide. The distributed and anonymized access attempts have been observed since mid-2019 and remain active into early 2021. In response, we have deployed WAF mitigations and accelerated the availability of our exposed credential check feature to all paid plans at no additional charge, ahead of its previously planned release later this month.

The attack chain described in the advisory follows a three-stage progression:

  1. Initial compromise of accounts through brute-force attacks against authentication endpoints.
  2. Network traversal using publicly known vulnerabilities, including CVE 2020-0688 and CVE 2020-17144, which widely affected Microsoft Exchange Servers.
  3. Deployment of remote access tools, such as a variant of the reGeorg web shell, followed by reconnaissance to gather additional information.

Credential Checks for All Paid Plans

The advisory underscores the persistent problem of password reuse and credential compromise affecting online applications across government and large private-sector properties. Our exposed credential check feature, first launched in beta during Security Week in March 2021, addresses this by notifying administrators whenever a login attempt uses a breached username and password pair. This signal can trigger stronger enforcement, such as requiring two-factor authentication, forcing a password reset, or increasing session logging.

Effective today, all paid plans (Pro and above) can enable this feature. Given the severity and ongoing nature of the exploitation attempts, we've expanded eligibility beyond the originally planned subset of customers. While we work on automatically deploying the capability across these plans, customers can request manual activation by submitting a support ticket with “Account Takeover Protections activation request” in the subject line.

Customers not yet on the new WAF, announced during Security Week, will be upgraded first. Accounts created after May 6, 2021, are already on the new version. The exposed credential managed ruleset can then be enabled with a single click for the following applications:

  • WordPress
  • Joomla
  • Drupal
  • Ghost
  • Magento
  • Plone
  • Microsoft Exchange

When enabled and a compromised credential is detected, the following header is added to the request sent to the origin server:

Exposed-Credential-Check: 1

This header alone doesn't provide security on its own, but it allows the origin server to enforce additional measures, such as requiring a two-factor authentication flow or password reset. The feature can also run in logging mode, making it easy to identify brute-force attacks against your application via the Firewall Analytics dashboard.

Applications outside the default set can still use the feature if their login endpoints conform to our generic rules. Two options are currently supported:

  • A JSON endpoint (application/json) submitting credentials with 'email' and 'password' keys, for example {“email”:”[email protected]”, “password”:”pass”}.
  • A standard login HTML form (application/x-www-form-urlencoded) under a URL containing “login”, with form fields named username and password respectively.

Developer documentation is available in our WAF exposed credentials check guide.

Updated WAF Rules for Web Shells

Beyond credential checks, we've implemented immediate improvements to the following WAF rules:

  • Improved rule 100197
  • Added a new rule 100197B (disabled by default)

These rules match against request payloads containing the reGeorg shell variant identified in the advisory. The improvements were informed by, but not limited to, the Yara rule in the advisory. The rules block payloads with these signatures and similar variations:

%@ Page Language=C#
StrTr
System.Net.IPEndPoint
Response.AddHeader
Socket

Hardening Authentication Endpoints

In addition to detecting compromised credentials, security administrators should adopt further best practices for authentication endpoints. These include multi-factor authentication, account time-out and lock-out features, and stronger authentication methods that require possession of something, such as a hard token or client certificate, rather than just knowledge of a username and password.

Several additional Cloudflare features can further strengthen your security posture:

  • Cloudflare Access provides strong, multi-factor authentication for internal and external applications, integrating directly with your organization's SSO and identity providers (IdP).
  • Mutual TLS rules (mTLS) in front of authentication endpoints considerably improves security by removing password dependencies. This can be configured as a Firewall Rule or as an option when setting up Cloudflare Access.
  • Managed IP list for Open Proxy endpoints, identified by Cloudflare's intelligence, can be used in Firewall Rules to challenge authentication endpoints with Captcha or other verification methods.
  • Bot Management detection, expanded to all self-serve paid plans via Super Bot Fight Mode, allows rules to challenge or block automated traffic such as brute-force bots while permitting verified bots to access internet properties normally.

Brute-force attacks remain a prevalent method for gaining initial access to private networks, especially when applications rely solely on username and password authentication. The advisory issued today confirms the widespread use of credential stuffing to breach systems, followed by pivoting to additional sensitive resources using other vulnerabilities. With the new WAF rules and the exposed credential check feature, now available to all paid plans ahead of schedule, customers have immediate tools to defend against these automated attacks. Support teams are ready to enable the feature manually while the broader rollout proceeds.