Spike in Telnet Connections

After an attacker compromises a device on a network, they might start searching for databases, file servers, and other critical assets to compromise. Remote access protocols, such as Telnet, can enable an attacker to laterally move across a network, from one compromised device to the next. First, the attacker sends a connection request over Telnet to one or more devices. If one of these devices has Telnet enabled, the attacker might be able to log in with stolen credentials. Each authenticated Telnet session enables the attacker to remotely access information, helping them get closer to achieving their ultimate attack campaign objective.