What Is Brute Force? How Attackers Crack Passwords and How to Stop Them

A brute force attack is a trial-and-error method where an attacker systematically tries password, credential, or key combinations until one works, exploiting weak authentication rather than any specific software vulnerability. MITRE ATT&CK classifies it as technique T1110 under the Credential Access tactic.

The technique doesn’t require cleverness, only volume and patience, or increasingly, automation that supplies both. Modern GPU clusters can crack an 8-character password hashed with older algorithms like MD5 in minutes, which is exactly why password length and proper hashing, not complexity rules alone, determine whether an account actually resists this kind of attack.

Six variants: simple, dictionary, hybrid, reverse, stuffing, and rainbow table

Brute force splits into six distinct variants, each targeting a different weakness: simple brute force tries every possible combination, dictionary attacks use common word lists, hybrid attacks combine dictionary words with variations, reverse brute force tests one known password against many usernames, credential stuffing reuses breached credentials, and rainbow table attacks reverse stolen password hashes using precomputed lookup tables.

Variant	Method
Simple	Every possible combination, brute computing power
Dictionary	Common words and known password lists
Hybrid	Dictionary words plus variations (numbers, symbols)
Reverse	One known password against many usernames
Credential stuffing	Reused credentials from other breaches
Rainbow table	Precomputed hash lookups to reverse stolen hashes

Microsoft’s 2025 Digital Defense Report found over 97% of identity attacks involve password spray or brute force in some form, a striking figure given how many other, more sophisticated attack techniques exist. The technique persists precisely because it remains this effective against weak or reused credentials, regardless of how advanced other parts of an organization’s security stack have become.

Password spraying: the technique built specifically to dodge lockouts

Password spraying, MITRE ATT&CK T1110.003, inverts the typical brute force approach: instead of trying many passwords against one account, which triggers lockout policies, the attacker tries one or two common passwords against thousands of accounts, staying below any single account’s failure threshold entirely.

This is a genuinely deliberate design choice, not an accident. Account lockout policies exist specifically to stop repeated guessing against one target, and password spraying was built by attackers precisely to route around that exact defense. Reverse brute force works almost identically but starts from a specific, known-breached password rather than a generic common guess, both exploiting the same structural gap: lockout policies protect individual accounts, not the organization’s entire user base tested one password at a time.

What is reconnaissance, and how does it precede a brute force attempt?

What is reconnaissance in cyber security: the information-gathering phase where an attacker collects details about a target before attempting compromise, employee names, email formats, exposed services, precisely the identity information a password spraying campaign needs to build a target list.

CISA’s own joint advisory on Iranian state-sponsored brute force campaigns states this connection directly: the actors “likely conduct reconnaissance operations to gather victim identity information,” then use that information to gain persistent access through brute force. Reconnaissance isn’t a separate, unrelated phase from brute force, it’s the preparation step that turns a generic password spraying attempt into a targeted one against real, valid usernames rather than guesses.

What is enumeration, and how does it hand attackers a target list?

Actively extracting specific, valid data from a target system, confirmed usernames, service versions, account structures, often by exploiting how a system responds differently to valid versus invalid input.

A login form that returns “invalid password” for a real username but “user not found” for a fake one is enumerable: an attacker automates thousands of attempts, harvests every username that returns the first message, and builds an exact, validated target list before ever attempting a single real password guess. This is the direct handoff point between reconnaissance and brute force, reconnaissance gathers likely candidates, enumeration confirms which candidates are genuinely real accounts worth targeting, and only then does the actual credential guessing begin against a list attackers already know is accurate.

How does this connect to Kerberoasting and other credential attacks?

Brute force and Kerberoasting share the same underlying goal, obtaining valid credentials, but attack it from opposite directions: brute force guesses credentials directly against a live authentication endpoint, while Kerberoasting extracts a crackable password hash from Active Directory’s own ticket-granting process and cracks it offline, away from any lockout policy entirely.

Attackers frequently chain both together: brute force or password spraying provides the initial low-privilege foothold, then Kerberoasting against service accounts inside that network extracts higher-value credentials without triggering any of the failed-login alerts a direct brute force attempt against a domain controller would generate. Understanding this chain matters because defending against brute force alone, rate limiting and lockouts on your login page, does nothing to stop the offline cracking Kerberoasting enables once an attacker is already inside.

Real cases: state-sponsored spraying and the Dell rate-limiting failure

CISA’s joint advisory AA24-290A documented Iranian state-sponsored actors using password spraying and MFA “push bombing” against US critical infrastructure since October 2023, selling harvested access to other cybercriminals once accounts were compromised. The Dell breach shows the same technique working just as effectively without any nation-state sophistication at all.

The Dell attackers didn’t guess passwords, they brute-forced customer “Service Tag” numbers directly against an API with no rate limiting, sustaining 5,000 requests per minute for three straight weeks before anyone noticed, ultimately exposing 49 million customer names and physical addresses. Neither case required a zero-day exploit or advanced malware. Both succeeded because a basic control, rate limiting on one side, phishing-resistant MFA on the other, was either missing or bypassable, proving this decades-old technique still works precisely because these specific gaps remain common in 2026.

Detecting it: low-and-slow patterns, impossible travel, and SIEM alerts

Detecting brute force means watching for patterns, not just volume: a single source IP generating failed logins across ten or more distinct accounts within a short window signals password spraying, while low-and-slow campaigns deliberately space attempts out to stay below typical SIEM alert thresholds entirely.

CISA’s advisory specifically recommends monitoring for suspicious logins from geographically distant IPs in short succession, unusual MFA registration changes, and dormant accounts suddenly showing activity, signals that catch brute force even when attackers pace their attempts to avoid triggering simple rate-based alerts. Teams already running EDR-based threat hunting should specifically tune detection rules around these identity-layer patterns, not just endpoint telemetry, since brute force activity often never touches an endpoint directly at all.

Brute force prevention that works: rate limiting, MFA, and passkeys

Brute force prevention that holds up requires layered controls: rate limiting on every authentication endpoint, phishing-resistant MFA rather than SMS-based codes, and passkeys where possible, since passkeys eliminate the shared secret brute force and credential stuffing both depend on entirely.

No single control closes every variant covered above. Rate limiting stops the Dell-style volume attack but does nothing against slow, spread-out password spraying. MFA blocks account takeover from a successfully guessed password but can itself be defeated by push bombing, as the Iranian campaign demonstrated. Passkeys close the gap furthest, since there’s no password to guess, spray, or stuff in the first place, making them the strongest long-term direction even though full rollout takes time. Layer these together rather than treating any single control as sufficient on its own.

Protocol-specific hardening: SSH, RDP, web apps, and APIs

Different protocols need different hardening specifics: SSH benefits from tools like fail2ban, which automatically bans IPs after repeated failed attempts, RDP should never sit exposed directly to the internet, and web applications and APIs need rate limiting applied at the endpoint level, exactly the control Dell’s portal lacked.

Fail2ban works by monitoring authentication logs and triggering a firewall-level ban once a defined failure threshold is crossed, a lightweight, genuinely effective control for SSH specifically that many smaller businesses never configure despite it costing nothing to deploy. For RDP, place it behind a VPN or zero trust access broker rather than exposing it directly, since RDP remains one of the most consistently brute-forced protocols across ransomware campaigns. For web applications and APIs, the Dell case is the clearest lesson available: any endpoint accepting authentication attempts, including ones that don’t look like a traditional login form, needs rate limiting applied deliberately, not assumed to exist by default.