Brute Force (T1110): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1110.
- Tactical Phase: Credential Access.
- Substantiated in 3 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (3)
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
"He used automated password brute force tools to guess administrative passwords on POS point-of-sale systems."
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts
Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.
"Adversaries utilized custom automated tooling named FROSTBITE to systematically test credentials across hundreds of customer tenant URLs and generate presigned staging URLs."
Microsoft Corporate Executive Email Intrusion (Midnight Blizzard / SVR)
Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.
"Adversaries executed a slow, distributed password spray against a non-production legacy tenant account that did not enforce multi-factor authentication."
Commonly Charged Criminal Statutes
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
Wire Fraud
Prohibits devising a scheme or artifice to defraud or obtain money or property by means of false or fraudulent pretenses, representations, or promises via wire communications.
Conspiracy to Commit Wire Fraud
Applies the same penalties as the underlying substantive wire fraud offense to any person who attempts or conspires to commit wire fraud.
Aggravated Identity Theft
Mandates a consecutive two-year prison sentence for knowingly transferring, possessing, or using without lawful authority a means of identification of another person during felony computer fraud or wire fraud.