Tashkent, Uzbekistan (UzDaily.uz) — Data leaks from free VPN services are increasingly being exploited by cybercriminals to attack corporate networks, according to a study conducted by threat intelligence and dark web monitoring service DLBI.
Experts analyzed over 200 datasets, including publicly released dumps and database samples offered for sale as user data from VPN services. In addition, specialists set up honeypots—special traps imitating corporate VPN services—to record unauthorized access attempts.
According to the study, more than 35% of login attempts into these honeypots utilized username and password combinations already present in the analyzed leaks from free VPN services. Another 20% of attempts involved modified versions of these passwords automatically generated by specialized scripts.
DLBI noted that the high proportion of attacks using credential reuse explains the growing demand for VPN service databases on the dark web. Experts believe this trend also drives the emergence of short-lived VPN services, which shut down quickly after attracting users without attempting to derive direct financial gain from them.
Ashot Oganesyan, founder and technical director of DLBI, stated that password reuse is becoming one of the most common methods for compromising corporate services, with VPN infrastructure coming under particularly high pressure from malicious actors.
He explained that while attackers previously faced difficulty mapping stolen credentials to specific companies, they now utilize information leaked from government entities alongside corporate email addresses that users themselves provide when registering for various online services.
DLBI recommends that companies pay special attention to protecting against credential-reuse attacks. Specifically, experts advise deploying specialized solutions to monitor leaks for exposed user credentials and automatically block accounts or mandate password resets for compromised accounts.
