Brute Force maps to Initial Access in the MITRE F3 Framework. It encompasses four distinct sub-techniques, each exploiting a different weakness in how organisations and individuals manage passwords.
Sub-techniques at a glance
| Sub-technique | How it works | Primary enabler |
|---|---|---|
| Credential Stuffing | Testing breach dump credentials on new services | Password reuse |
| Password Cracking | Recovering plaintext from stolen hashes | Weak password policies |
| Password Guessing | Trying common passwords manually or by list | Predictable password choices |
| Password Spraying | One common password tested across many accounts | Avoids lockout thresholds |
What enables brute force attacks at scale?
The primary enabler is password reuse. When employees use the same password across personal and corporate services, a breach of an unrelated third-party site instantly creates valid credentials for corporate systems. Credential stuffing automates this at millions of attempts per hour.
Password spraying is a more targeted variant: rather than locking out a single account by guessing many passwords, the attacker tests one common password (e.g., Summer2024!) across hundreds of accounts; staying below lockout thresholds and avoiding detection in Windows event logs.
How does brute force relate to social engineering?
Brute force does not require social engineering; but social engineering dramatically accelerates it. Phishing for Information campaigns frequently target password resets or MFA codes, converting a brute force attempt into a direct credential theft.
Key takeaways
- Brute Force covers four sub-techniques in Initial Access: credential stuffing, cracking, guessing, and spraying.
- Password reuse is the primary vulnerability exploited by credential stuffing.
- Password spraying deliberately stays under account lockout thresholds to avoid detection.
- Organisations with weak password policies and no MFA are disproportionately exposed.
- Brute force and phishing are frequently combined in multi-stage fraud attacks.
What is MITRE Fight Fraud Framework™ (F3)?
The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope.
