Brute-force attack

An attack in which someone tries large numbers of password or key combinations, often automatically, until they find one that works.

In a brute-force attack, software rapidly guesses passwords, sometimes working through every possible combination and sometimes using lists of common passwords and words. Related techniques include password spraying, where an attacker tries a few common passwords across many accounts to avoid lockouts.

Any login exposed to the internet will be tested this way. Remote desktop connections, VPN portals, email accounts and website administration pages are frequent targets. A short or common password can fall quickly, and once one account is compromised, it can be used to send phishing emails to your clients or to explore your network further.

Practical tip: require long passphrases rather than short complex passwords, enable account lockout or throttling after repeated failures, and turn on multi-factor authentication everywhere you can. Avoid exposing remote desktop directly to the internet. If you need remote access, put it behind a properly secured VPN or a remote access service with strong authentication.