--- id: CP-038 slug: brute-force-attack-gpu-asic lang: en title: Brute force attacks and computing power description: How an attacker tests thousands of passwords, online or on a stolen database, and what an employee sees and can do about it. canonical_url: https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic/ markdown_url: https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Brute force attacks and computing power", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic/ (CC BY 4.0) wing: 1 theme: master_passwords reflex: cr-010 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic/ fr: https://startbrain.io/cyberpedia/fr/articles/attaque-force-brute-gpu-asic/ de: https://startbrain.io/cyberpedia/de/articles/brute-force-angriff-gpu-asic/ es: https://startbrain.io/cyberpedia/es/articles/ataque-fuerza-bruta-gpu-asic/ sources: - "n": 1 title: Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/ accessed: "2026-11-03" - "n": 2 title: "Brute Force: Password Cracking, Sub-technique T1110.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/002/ accessed: "2026-11-03" - "n": 3 title: Pourquoi et comment bien gérer ses mots de passe ? - Assistance aux victimes de cybermalveillance publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe published: "2019-11-23" accessed: "2026-11-03" - "n": 4 title: "Brute Force: Credential Stuffing, Sub-technique T1110.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/004/ accessed: "2026-11-03" - "n": 5 title: "Brute Force: Password Spraying, Sub-technique T1110.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/003/ accessed: "2026-11-03" - "n": 6 title: "Brute Force: Password Guessing, Sub-technique T1110.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1110/001/ accessed: "2026-11-03" - "n": 7 title: SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a published: "2024-02-26" accessed: "2026-11-03" - "n": 8 title: NIST Special Publication 800-63B publisher: NIST url: https://pages.nist.gov/800-63-3/sp800-63b.html accessed: "2026-11-03" --- # Brute force attacks and computing power A brute force attack consists of trying passwords one after another until the right one is found. It targets accounts whose password the attacker does not know, or password fingerprints (hashes) that the attacker has obtained [1]. For an employee, a short or common password falls quickly, whether the attack targets the company's login page or a stolen database. ## In 30 seconds - Where it happens: on a login service (email, VPN, remote access), or offline, on password hashes that have already been stolen [1]. - What the attacker wants: a plaintext password that can be used to log in to every system the account gives access to [2]. - The reflex: a long, unique password for each service, kept in a password manager, with two-factor authentication when it exists [3]. - If it has already happened: change the password immediately at the slightest suspicion [3]. ## Straight answers ### What is a brute force attack? It is a systematic search, by a repetitive mechanism, for an unknown password [1]. It takes place either by querying a service that checks credentials, or offline against data that has already been stolen, such as hashes [1]. Cybermalveillance.gouv.fr states that these attacks, carried out by computers, can test tens of thousands of combinations per second [3]. ### What is the difference between an online and an offline attack? Online, the attacker goes through the login service, which can count failures and block. Offline, the attacker already has the hashes and usually works on their own machines, outside the victim's network [2]. ### Is my password at risk if another site has been hacked? Yes, if it is reused. When a site is compromised, large quantities of username and password pairs are sometimes published. The attacker tries them on other accounts, counting on the tendency to reuse the same password at home and at work [4]. ### Is a lockout rule enough? No. Password spraying gets around lockout: the attacker tries a single common password, or a short list, on many accounts, to avoid the blocks that would hit an account targeted by many attempts [5]. And a lockout that is too strict can block every targeted account and make the environment unusable [1]. ## Inside the attacker's head The attacker chooses a method according to what they have. With nothing, they guess: they try a list of common passwords, with or without regard for the target's complexity policy [6]. This choice is risky for them, because it can cause many failures and lockouts [6]. With a list of credentials from a leak, they move to credential stuffing [4]. With a single common password tried on many accounts, it is password spraying [5]. With hashes, they crack the passwords offline, by systematic search or with a precomputed table called a rainbow table [2]. The targeted services are often administration services on common ports: SSH, RDP, SMB or LDAP, for example [5]. Cloud applications and email exposed on the Internet, such as Office 365, are targeted too [6]. An attacker can also adapt their environment. If they find the right password but location-based access rules stop them, they can change infrastructure until it matches the victim's location [1]. ## What you see on screen The victim of an online attack mainly sees indirect effects: a lockout rule can block their account [1]. In the logs, failed SMB logins produce Windows event 4625; LDAP and Kerberos attempts trigger it less often [6]. The classic signal for security teams is a large number of failures followed by a success, from a suspicious user, machine or time of day [1]. Password spraying is spotted by attempts spread across many accounts within a short interval [1]. Another sign: two-factor authentication approval requests that you did not trigger. CISA describes the "MFA bombing" or "MFA fatigue" technique, in which the attacker pushes requests to the victim's device until they accept [7]. After an offline attack, the visible sign is a sudden, valid login from an account whose hashes had been stolen [2]. ## Under the hood A password is normally not stored in plaintext, but as a hash. The cited page is NIST revision SP 800-63-3, replaced by SP 800-63-4 since 1 August 2025 [8]. That revision required passwords to be salted and then hashed with a suitable key derivation function [8]. Such a function takes the password, a salt and a cost factor as input, and produces the hash [8]. The salt must be at least 32 bits long and be chosen arbitrarily to limit collisions between stored hashes [8]. The purpose of this design is to make each of the attacker's guesses expensive, and therefore the whole attack costly, even prohibitive [8]. For PBKDF2, the cost is a number of iterations: the higher it is, the longer the hash takes to compute, and NIST recommended an iteration count as high as the server allows, typically at least 10,000 [8]. NIST also recommended a memory-hard function, which increases the cost of an attack [8]. Computing power weighs on this cost. NIST noted that attackers can compute many billions of hashes per second without rate limiting, which required passwords orders of magnitude more complex than those that only have to withstand online attacks [8]. The sources read do not detail the role of graphics processors (GPUs) or ASIC circuits. MITRE only mentions, among the signs of hash cracking, the use of tools such as John the Ripper or Hashcat with heavy processor load or a call to the GPU [2]. Online, that revision required limiting consecutive failures on an account to 100 at most, and suggested lengthening the wait as the cap approaches (from 30 seconds to one hour) or requiring a CAPTCHA [8]. For passwords, it set a minimum of 8 characters and asked that passwords appearing on a list of compromised values be refused [8]. Cybermalveillance.gouv.fr recommends at least 12 characters mixing uppercase, lowercase, digits and special characters [3]. ## Case files ### February 2024: the CISA advisory on the APT29 group On 26 February 2024, CISA published advisory AA24-057A with the UK NCSC and partners. It describes the methods of the APT29 group, also called Midnight Blizzard, which these agencies judge to be almost certainly part of the SVR, the Russian intelligence service [7]. The methods described were observed over the last 12 months [7]. Earlier campaigns succeeded, through brute force and password spraying, in gaining access to service accounts [7]. These accounts have no human user, so they are poorly protected by two-factor authentication, and they are often highly privileged [7]. The group also targeted dormant accounts of former employees [7]. It used residential proxies so that its connections looked like those of ordinary users [7]. ### 2016: an attack on the Ukrainian power grid During the 2016 attack on the Ukrainian power grid, Sandworm Team used a script to attempt RPC authentication against several machines [1]. ### 2025: wiping attacks in Poland During the 2025 attacks in Poland, which aimed to wipe data, the attackers attempted to crack user passwords [2]. ### April 2026: a report on an AI-assisted intrusion in Mexico MITRE cites an intrusion against Mexican government infrastructure, documented in April 2026. The attacker had Claude Code attempt brute force SSH logins [1], and crack password hashes from the victim organizations' databases [2]. ## Sources 1. MITRE ATT&CK, "Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Brute Force: Password Cracking, Sub-technique T1110.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/002/ (accessed 3 November 2026) 3. Cybermalveillance.gouv.fr, "Pourquoi et comment bien gérer ses mots de passe ? - Assistance aux victimes de cybermalveillance", 23 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe (accessed 3 November 2026) 4. MITRE ATT&CK, "Brute Force: Credential Stuffing, Sub-technique T1110.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/004/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Brute Force: Password Spraying, Sub-technique T1110.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/003/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Brute Force: Password Guessing, Sub-technique T1110.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1110/001/ (accessed 3 November 2026) 7. CISA, "SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA", 26 February 2024. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a (accessed 3 November 2026) 8. NIST, "NIST Special Publication 800-63B". https://pages.nist.gov/800-63-3/sp800-63b.html (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.