Procedure examples

SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.

PcShare has used a variety of Windows API functions.

AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.

Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.

Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.

Donut code modules use various API functions to load and inject code.

ZeroCleare can call the `GetSystemDirectoryW` API to locate the system directory.

During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.

APT41 performed password brute-force attacks on the local admin account.

Dragonfly has attempted to brute force credentials to gain access.

APT39 has used Ncrack to reveal credentials.

OilRig has used brute force techniques to obtain credentials.

Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.

Storm-0501 has leveraged brute force attacks to obtain credentials.

DarkVishnya used brute-force attack to obtain login data.

FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.

Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.

Agrius engaged in various brute forcing activities via SMB in victim environments.

APT28 can perform brute force attacks to obtain credentials.

Fox Kitten has brute forced RDP credentials.

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.

HEXANE has used brute force attacks to compromise valid credentials.

Chaos conducts brute force attacks against SSH services to gain initial access.

Caterpillar WebShell has a module to perform brute force attacks on a system.

Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.

Kinsing has attempted to brute force hosts over SSH.

QakBot can conduct brute force attacks to capture credentials.

PoshC2 has modules for brute forcing local administrator and AD user accounts.

CrackMapExec can brute force supplied user credentials across a network range.

ShinyHunters has performed brute force attacks against edge devices, such as VPNs or firewall solutions.

APT29 has successfully conducted password guessing attacks against a list of mailboxes.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.

VOID MANTICORE has conducted password guessing to gain initial access.

Pony has used a small dictionary of common passwords against a collected list of local accounts.

Emotet has been observed using a hard coded list of passwords to brute force user accounts.

P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.

Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and passwords.

China Chopper's server component can perform brute force password guessing against authentication portals.

Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.

SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.

HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.

CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.

During the 2025 Poland Wiper Attacks, the adversaries attempted to crack user passwords.

During Night Dragon, threat actors used Cain & Abel to crack password hashes.

APT3 has been known to brute force password hashes to be able to leverage plain text credentials.

Salt Typhoon has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.

Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.