{
  "family": "brutus",
  "sample_count": 0,
  "category": "tool",
  "description": "Brutus is a widely recognized and versatile password-cracking utility that has been utilized by both security professionals and malicious actors for over two decades. Operating primarily on Windows systems, Brutus is categorized as a remote password cracker that specializes in brute-force and dictionary attacks against various network services. It natively supports protocols such as HTTP (Basic Authentication), FTP, POP3, Telnet, and SMB. What sets Brutus apart is its customizable nature, allowing users to define specific authentication sequences and import extensive wordlists. While its age means it lacks support for modern cryptographic standards and secured protocols like HTTPS, it remains an effective tool against legacy systems and misconfigured servers. Its existence underscores the critical need for strong password policies and the implementation of multi-factor authentication (MFA) across all services.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Brutus Password Cracker",
    "Brutus AET"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Brutus in the context of cybersecurity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Brutus is a legacy remote password-cracking tool used to perform brute-force and dictionary attacks."
      }
    },
    {
      "@type": "Question",
      "name": "What protocols does Brutus support?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It supports several older protocols, including FTP, POP3, Telnet, and basic HTTP authentication."
      }
    },
    {
      "@type": "Question",
      "name": "Is Brutus still effective today?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "While largely ineffective against modern, secure systems, it can still compromise legacy or misconfigured services."
      }
    },
    {
      "@type": "Question",
      "name": "Who uses the Brutus tool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It has been used historically by both penetration testers for security auditing and attackers for malicious access."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems defend against tools like Brutus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenses include implementing account lockout policies, using strong passwords, and enabling Multi-Factor Authentication (MFA)."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1110",
    "T1078"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1110",
      "name": "Brute Force",
      "tactic": "Credential Access"
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Brutus binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Brutus installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "SecurityFocus Vulnerability Database - Brutus Network Authentication Cracker",
      "url": "https://www.securityfocus.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-1999-0504",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-0504"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2000,
  "motivation": "Credential Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Telecommunications",
    "Information Technology"
  ],
  "lineage": {
    "derived_from": [
      "legacy_network_authentication_bruteforcers"
    ],
    "variants": [
      "brutus_aet2",
      "brutus_fast"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-NTA",
    "D3-FPA",
    "D3-AL",
    "D3-MFA"
  ],
  "cve": [
    "CVE-1999-0504",
    "CVE-2000-0222"
  ],
  "iocs": {
    "file_hashes": [
      "c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7"
    ],
    "delivery": [
      "Direct operator execution from offensive security toolkits or compromised jump boxes",
      "Scripted distribution within multi-stage credential harvesting toolkits"
    ],
    "persistence": [
      "Operator-managed standalone binary execution (does not install standalone persistence hooks)",
      "Scheduled automated batch jobs configured via Windows AT or Task Scheduler"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}