Cyberpediaby Brain
ENDEFR

Brute force attacks and computing power

How an attacker tests thousands of passwords, online or on a stolen database, and what an employee sees and can do about it.

In 30 seconds

Where it happens
On a login service (email, VPN, remote access), or offline, on password hashes that have already been stolen1.
What the attacker wants
A plaintext password that can be used to log in to every system the account gives access to2.
The reflex
A long, unique password for each service, kept in a password manager, with two-factor authentication when it exists3.
If it has already happened
Change the password immediately at the slightest suspicion3.

What it is

A brute force attack consists of trying passwords one after another until the right one is found. It targets accounts whose password the attacker does not know, or password fingerprints (hashes) that the attacker has obtained1.

For an employee, a short or common password falls quickly, whether the attack targets the company's login page or a stolen database.

Straight answers

What is a brute force attack?

It is a systematic search, by a repetitive mechanism, for an unknown password1. It takes place either by querying a service that checks credentials, or offline against data that has already been stolen, such as hashes1. Cybermalveillance.gouv.fr states that these attacks, carried out by computers, can test tens of thousands of combinations per second3.

What is the difference between an online and an offline attack?

Online, the attacker goes through the login service, which can count failures and block. Offline, the attacker already has the hashes and usually works on their own machines, outside the victim's network2.

Is my password at risk if another site has been hacked?

Yes, if it is reused. When a site is compromised, large quantities of username and password pairs are sometimes published. The attacker tries them on other accounts, counting on the tendency to reuse the same password at home and at work4.

Is a lockout rule enough?

No. Password spraying gets around lockout: the attacker tries a single common password, or a short list, on many accounts, to avoid the blocks that would hit an account targeted by many attempts5. And a lockout that is too strict can block every targeted account and make the environment unusable1.

1Inside the attacker's head1 min

The attacker chooses a method according to what they have. With nothing, they guess: they try a list of common passwords, with or without regard for the target's complexity policy6. This choice is risky for them, because it can cause many failures and lockouts6.

With a list of credentials from a leak, they move to credential stuffing4. With a single common password tried on many accounts, it is password spraying5. With hashes, they crack the passwords offline, by systematic search or with a precomputed table called a rainbow table2.

The targeted services are often administration services on common ports: SSH, RDP, SMB or LDAP, for example5. Cloud applications and email exposed on the Internet, such as Office 365, are targeted too6.

An attacker can also adapt their environment. If they find the right password but location-based access rules stop them, they can change infrastructure until it matches the victim's location1.

2What you see on screen1 min

The victim of an online attack mainly sees indirect effects: a lockout rule can block their account1. In the logs, failed SMB logins produce Windows event 4625; LDAP and Kerberos attempts trigger it less often6.

The classic signal for security teams is a large number of failures followed by a success, from a suspicious user, machine or time of day1. Password spraying is spotted by attempts spread across many accounts within a short interval1.

Another sign: two-factor authentication approval requests that you did not trigger. CISA describes the "MFA bombing" or "MFA fatigue" technique, in which the attacker pushes requests to the victim's device until they accept7.

After an offline attack, the visible sign is a sudden, valid login from an account whose hashes had been stolen2.

3Under the hoodIT teams2 min

A password is normally not stored in plaintext, but as a hash. The cited page is NIST revision SP 800-63-3, replaced by SP 800-63-4 since 1 August 20258. That revision required passwords to be salted and then hashed with a suitable key derivation function8. Such a function takes the password, a salt and a cost factor as input, and produces the hash8. The salt must be at least 32 bits long and be chosen arbitrarily to limit collisions between stored hashes8.

The purpose of this design is to make each of the attacker's guesses expensive, and therefore the whole attack costly, even prohibitive8. For PBKDF2, the cost is a number of iterations: the higher it is, the longer the hash takes to compute, and NIST recommended an iteration count as high as the server allows, typically at least 10,0008. NIST also recommended a memory-hard function, which increases the cost of an attack8.

Computing power weighs on this cost. NIST noted that attackers can compute many billions of hashes per second without rate limiting, which required passwords orders of magnitude more complex than those that only have to withstand online attacks8. The sources read do not detail the role of graphics processors (GPUs) or ASIC circuits. MITRE only mentions, among the signs of hash cracking, the use of tools such as John the Ripper or Hashcat with heavy processor load or a call to the GPU2.

Online, that revision required limiting consecutive failures on an account to 100 at most, and suggested lengthening the wait as the cap approaches (from 30 seconds to one hour) or requiring a CAPTCHA8. For passwords, it set a minimum of 8 characters and asked that passwords appearing on a list of compromised values be refused8. Cybermalveillance.gouv.fr recommends at least 12 characters mixing uppercase, lowercase, digits and special characters3.

4Case filesReal cases1 min

February 2024: the CISA advisory on the APT29 group

On 26 February 2024, CISA published advisory AA24-057A with the UK NCSC and partners. It describes the methods of the APT29 group, also called Midnight Blizzard, which these agencies judge to be almost certainly part of the SVR, the Russian intelligence service7. The methods described were observed over the last 12 months7.

Earlier campaigns succeeded, through brute force and password spraying, in gaining access to service accounts7. These accounts have no human user, so they are poorly protected by two-factor authentication, and they are often highly privileged7. The group also targeted dormant accounts of former employees7. It used residential proxies so that its connections looked like those of ordinary users7.

2016: an attack on the Ukrainian power grid

During the 2016 attack on the Ukrainian power grid, Sandworm Team used a script to attempt RPC authentication against several machines1.

2025: wiping attacks in Poland

During the 2025 attacks in Poland, which aimed to wipe data, the attackers attempted to crack user passwords2.

April 2026: a report on an AI-assisted intrusion in Mexico

MITRE cites an intrusion against Mexican government infrastructure, documented in April 2026. The attacker had Claude Code attempt brute force SSH logins1, and crack password hashes from the victim organizations' databases2.

Fact sheet

Identifier
CP-038
Wing
1. Attacks and techniques
Brain skill
Mastering Passwords & MFA (master_passwords)
Brain reflex
cr-010
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. MITRE ATT&CK, “Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Brute Force: Password Cracking, Sub-technique T1110.002 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/002/ (accessed 3 November 2026)
  3. Cybermalveillance.gouv.fr, “Pourquoi et comment bien gérer ses mots de passe ? - Assistance aux victimes de cybermalveillance”, 23 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/mots-de-passe (accessed 3 November 2026)
  4. MITRE ATT&CK, “Brute Force: Credential Stuffing, Sub-technique T1110.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/004/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Brute Force: Password Spraying, Sub-technique T1110.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/003/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Brute Force: Password Guessing, Sub-technique T1110.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1110/001/ (accessed 3 November 2026)
  7. CISA, “SVR Cyber Actors Adapt Tactics for Initial Cloud Access | CISA”, 26 February 2024. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a (accessed 3 November 2026)
  8. NIST, “NIST Special Publication 800-63B”. https://pages.nist.gov/800-63-3/sp800-63b.html (accessed 3 November 2026)

Cite this article

Brain, “Brute force attacks and computing power”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic/

BibTeX 
@misc{brain_cp038_en_2026,
  author = {Brain},
  title = {Brute force attacks and computing power},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/brute-force-attack-gpu-asic/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence