1. Introduction

Brute force attack protection is rarely the first thing that comes to mind when a company thinks about its cybersecurity budget, and that is exactly the problem. In 2026, brute force remains the first door attackers try before spending a single hour on exploits or malware. It does not trigger red lights in most companies because failed attempts are archived in the SIEM as background noise that nobody reads. But one successful guess is all it takes for that noise to become access with legitimate credentials.

The paradox is that brute force attack protection is also one of the few areas where the balance tips in favor of the defender: with universal MFA, services kept off the public internet and minimal monitoring, tens of thousands of daily attempts become irrelevant noise. In this article we explain the types of attacks that exist, which services are hit the hardest, why RDP remains the number one target and how to build an effective brute force attack protection strategy in five fronts, following the chapter on brute force and dictionary attacks in the author’s book “Protocolos y procedimientos prácticos de ciberseguridad” (Confemetal, 2026).

2. Brute Force and Dictionary Attacks: Two Ways of Guessing Passwords

A classic brute force attack tries character combinations systematically. A dictionary attack, far more efficient, uses lists of real leaked passwords: the historic RockYou list contains 14 million passwords and the COMB compilation (Combined Online Breach) exceeds 3 billion entries. With transformation rules, a 14-million-entry dictionary multiplies until it covers most human patterns.

The most important distinction is online versus offline. In an online attack, every attempt travels over the network to the real service, which limits speed: a well-configured server can block more than a few failures per minute. In an offline attack, the situation changes: the attacker has stolen password hashes (for example, an Active Directory dump) and tests them on their own hardware at billions of combinations per second with Hashcat or John the Ripper. An RTX 4090 reaches around 300 billion NTLM hashes per second, and an eight-character alphanumeric password is exhausted in minutes.

Defense depends on the scenario: against online attacks, rate limiting, lockout and MFA work; against offline attacks, only real password length and a robust hashing algorithm such as bcrypt with cost 12 or Argon2id work. This asymmetry explains why “change your password every 90 days” stops nobody, and why requiring 12 or 16 characters does. It also explains why brute force attack protection always starts with the question: is this password guessable offline, or only online?

3. The Favorite Targets: RDP, SSH and Web Panels

The book ranks the most attacked services and the result is stable year after year: remote access holds the first position, with RDP (port 3389) as the most battered target in the ecosystem. It is followed by SSH, SSL/IPsec VPNs (Citrix, AnyConnect), web panels on predictable paths such as /admin or /wp-admin, email over IMAP, POP3, SMTP auth and OWA, and public APIs without rate limiting. Honeypots at AbuseIPDB and SANS ISC record tens of thousands of daily attempts against RDP and SSH as a normal pattern.

Service	Typical port	What it exposes	Attractiveness to attackers
RDP	3389	Complete Windows desktop	Very high: the preferred initial access for ransomware
SSH	22	Shell access to Linux/Unix servers	High: reused credentials across servers
Web panels	80/443	/admin, /wp-admin, cPanel	High: automated by botnets
Email	143, 993, 25, 587	IMAP, POP3, SMTP auth, OWA	Medium: constant campaigns against M365 and Workspace
Public APIs	443	Business endpoints without rate limiting	Growing: direct access to data and logic

Fig. 1 – Most attacked services and their exposure, according to the brute force chapter of “Protocolos y procedimientos prácticos de ciberseguridad”.

RDP deserves special attention: it is the initial access vector most cited in ransomware incidents over the last years. An RDP exposed to the internet with a local administrator account and a weak password is an open invitation: global scanners such as Shodan and Censys find it within minutes, and botnets probe it continuously around the clock.

4. Variants That Make No Noise: Credential Stuffing and Password Spraying

A classic brute force attack throws many passwords at one user. Its modern variants invert the logic to avoid lockouts. Credential stuffing takes lists of leaked credentials (millions of user-password pairs from previous breaches) and tests them against corporate services, exploiting password reuse: Google measured that around 1.5% of sign-ins use credentials already compromised in breaches. With COMB-sized lists, the attacker does not need to guess anything: they already have the password and simply reuse it.

Password spraying does the opposite: one or a few very common passwords (the typical ones, the seasonal ones, the company name) tested against thousands of accounts. By staying below the lockout threshold of each individual account, it evades rate limiting controls and the noisy event 4625 in Active Directory. Tools such as Kerbrute do it over Kerberos without generating those noisy events, and CISA maintains specific alerts about spraying campaigns against Microsoft 365 and Active Directory.

5. The Attacker’s Toolbox

The attacker picks the tool according to the phase. For online attempts against services, Hydra, Medusa or Patator are the standard; for offline attacks on stolen hashes, Hashcat and John the Ripper; for lateral movement inside the network, CrackMapExec or NetExec; and for commercial stuffing, platforms such as Sentry MBA or OpenBullet that automate the process with rotating proxies:

# Typical online attack (authorized environments only)
hydra -l admin -P rockyou.txt rdp://192.168.10.20
hydra -L users.txt -P dictionary.txt ssh://corporate.server

# Offline attack on stolen hashes with transformation rules
hashcat -m 1000 ntlm_hashes.txt rockyou.txt -r rules.rule

Fig. 2 – Examples of online and offline brute force tools cited in the book’s chapter 8. Using them against systems you do not own is a crime.

Knowing these tools is not theory: it defines what protection each layer needs. If the attacker can run millions of attempts per second offline, the password “Summer2023” has no protection at all; if they can only make five attempts per minute online, MFA stops them almost every time.

6. The Defense in Five Fronts

The book proposes five fronts that work together. The first is reducing the attack surface: RDP, SSH and administrative panels should not be exposed to the internet. They are replaced by VPN with MFA or, better, by ZTNA (Cloudflare Access, Zscaler Private Access, Entra Private Access, Netskope), where access is granted to a specific resource rather than to the network. That single move eliminates most daily attempts.

The second is a modern password policy: 12 characters minimum (16 or more for privileged accounts), checking new passwords against known-breached lists (HIBP), and robust algorithms (Argon2id, bcrypt with cost 12, scrypt) in your own systems. The third is universal MFA: TOTP or push stops automated attacks, FIDO2 resists man-in-the-middle attacks and number matching protects against MFA fatigue.

The fourth front is rate limiting, lockout and challenges. A typical threshold is around five failures per minute per user, with progressive lockout of 1, then 5, then 15 minutes, as NIST recommends, so that legitimate users are not locked out. Add adaptive CAPTCHA (Cloudflare Turnstile, hCaptcha) on panels and login, plus geoblocking: for most Spanish businesses, a country allow-list admitting only Spain eliminates around 95% of attack noise.

The fifth front is detection with SIEM rules, the monitoring half of any brute force attack protection program. The most valuable signatures are: many failures followed by a success from the same source IP, logins from an unusual geography or ASN, the same password distributed across several accounts (spraying), non-human request speeds and traffic from IPs known to be malicious in AbuseIPDB, FireHOL or Emerging Threats:

# Conceptual SIEM rule: many failures and then a success
event.origin == "wazuh-indexer" AND
logon.failure >= 10 within 15 minutes AND
logon.success == true within 10 minutes after failures

Fig. 3 – Conceptual SIEM rule to detect successful brute force, inspired by the book.

7. What to Do If You Are Being Attacked

If the attack is ongoing and has not succeeded, the response is tactical: block the source IP (by ASN or country if the source is distributed), harden thresholds within 24-48 hours, enable CAPTCHA and enforce hardware MFA on critical accounts, inform the IT team and consider the national CSIRTs (INCIBE-CERT or CCN-CERT). Keep the logs: they are the basis for reporting and later analysis.

If the attack has succeeded, this is no longer a brute force incident: it is an intrusion. The response is the one for any compromise: rotate the affected credential and revoke all active sessions, analyze the user’s subsequent activity, look for lateral movement from their IP and, if the account was privileged, do a full Active Directory review, rotate the krbtgt secret twice (to invalidate possible Golden Tickets) and audit new accounts and group memberships. Evidence collection must follow forensic standards such as ISO/IEC 27037:2012 and RFC 3227 if the case may end up in court. Afterwards, review the policy: expand MFA, strengthen SIEM rules with the observed pattern and validate with a pentest. Related to this process, you may find useful our article on what to do if your email credentials are stolen: immediate actions after credential theft, as well as our guide to risk analysis for companies to prioritize these investments.

8. Conclusion

Brute force is the attacker’s cheapest vector and the one most companies dismiss, precisely because it is routine. But a weak password on RDP or an account without MFA is enough for that routine to become the starting point of a ransomware incident. The good news, documented in the book, is that brute force is one of the few vectors where the defender has the advantage: taking services off the internet, applying progressive lockout thresholds, enabling universal MFA and monitoring with SIEM rules turns tens of thousands of daily attempts into irrelevant noise. Brute force attack protection does not require exotic technology: five fronts, and the asymmetry changes sides.

Need help with Brute force attack protection?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.