# What is Brute Force?
Source: https://arsen.co/en/resources/brute-force
Summary: Brute Force is an initial access technique. Fraud actors use credential stuffing, password spraying, and cracking to gain unauthorized account access.

**Brute Force maps to Initial Access in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). It encompasses four distinct sub-techniques, each exploiting a different weakness in how organisations and individuals manage passwords.**

## Sub-techniques at a glance

| Sub-technique | How it works | Primary enabler |
|---|---|---|
| Credential Stuffing | Testing breach dump credentials on new services | Password reuse |
| Password Cracking | Recovering plaintext from stolen hashes | Weak password policies |
| Password Guessing | Trying common passwords manually or by list | Predictable password choices |
| Password Spraying | One common password tested across many accounts | Avoids lockout thresholds |

## What enables brute force attacks at scale?

The primary enabler is **password reuse**. When employees use the same password across personal and corporate services, a breach of an unrelated third-party site instantly creates valid credentials for corporate systems. Credential stuffing automates this at millions of attempts per hour.

Password spraying is a more targeted variant: rather than locking out a single account by guessing many passwords, the attacker tests one common password (e.g., `Summer2024!`) across hundreds of accounts; staying below lockout thresholds and avoiding detection in Windows event logs.

## How does brute force relate to social engineering?

Brute force does not require social engineering; but social engineering dramatically accelerates it. [Phishing for Information](https://arsen.co/en/resources/phishing-for-information) campaigns frequently target password resets or MFA codes, converting a brute force attempt into a direct credential theft.

## Key takeaways

- Brute Force covers four sub-techniques in **Initial Access**: credential stuffing, cracking, guessing, and spraying.
- Password reuse is the primary vulnerability exploited by credential stuffing.
- Password spraying deliberately stays under account lockout thresholds to avoid detection.
- Organisations with weak password policies and no MFA are disproportionately exposed.
- Brute force and [phishing](https://arsen.co/en/resources/phishing) are frequently combined in multi-stage fraud attacks.

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)