Just recently, I've been seeing a number of attempts to log into my box, using the user "admin".

These are not part of the usual brute force attacks that I see, when they try hundreds of user names. These are just a single attempt, always with "admin".

Is there some new exploit that they're trying to use.

Cheers.

Maybe someone is looking for a specific type of device with a known default password set ...

Could an MS guy; expecting admin to exist instead of 'root'.
Alternatively, I believe some people create an admin with root privs user so they can happily block remote root logins, but still get superuser work done.
It's an obvious choice of name for an alternate eg like 'mgr'.

System-level accounts can actually be given any name. The name of the account shouldn't define the severity of the attack.

I'd be concerned whether it was 'admin', 'root', or 'httpd'. This is more than likely an automated bruteforcing attempt. It's looking for all combinations of usernames and passwords, more than likely. Not all such attacks look for default usernames and passwords. Some actually run dictionary attacks (which are more exhaustive, but slower in duration). It depends on the persistence of the attack.

This is why I always use key-based authentication. The attacker can guess all they want, but their attempts are rejected when they don't present the proper key.

That's what I'm more used to, where it tries hundreds, or thousands of names. None of which are ever going to work, because I only allow "public key", and disable password authentication.

It's just this sudden spate of "single" attempts that I find strange.

Cheers.

Sounds like a 'slow brute force distributed attack' eg see http://bsdly.blogspot.com/2009/10/th...uncharmed.html
http://www.linuxquestions.org/questi...ttacks-771978/

An attempt to get around tools like fail2ban.