Activity timeline
T1110.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 12 reports, and 41 of the 41 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1110.003 Password Spraying is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of T1110 Brute Force. Threadlinqs maps 41 of 2623 tracked threats (1.6%) to it; by severity that is 13 critical, 26 high, 2 medium.
Threats that use T1110.003 most often also use T1190 Exploit Public-Facing Application (23 threats), T1018 Remote System Discovery (18 threats), T1078 Valid Accounts (17 threats), T1021.002 SMB/Windows Admin Shares (14 threats), T1059.001 PowerShell (12 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
25 tracked threat actors appear in the threats that use T1110.003; the most frequent are Akira (3), Storm-1567 (3), NoName057(16) (2), Qilin (2), ShinyHunters (2).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1110.003.
Data sources
Telemetry that can reveal T1110.003, per MITRE ATT&CK.
- Application Log — Application Log Content
- User Account — User Account Authentication
Threat actors using it
Tracked threats
The 30 most recent of 41 tracked threats that use T1110.003.
- AI-accelerated intrusions: Microsoft 2026 Digital Defense Report on phishing, public-facing app…high
- Attackers Abuse Microsoft SQL Server xp_cmdshell as Command and Base64 Data-Exfiltration Channel in Viva…high
- The First 24 Hours of a Ransomware Intrusion: Exfiltration, Credential Theft and Backup Targeting (Akira…high
- CISA adds two Zammad vulnerabilities to KEV: CVE-2026-102489 (session fixation to RCE) and CVE-2026-102490…critical
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs…critical
- Agentic AI used for post-exploitation in breach of the Dutch Institute for Vulnerability Disclosure (DIVD)high
- ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing…high
- ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leakcritical
- Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…critical
- TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service…high
- France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Monthshigh
- Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential…high
- BREEZE COMET (ex-UNC5669) Targets Brazilian Financial Infrastructure with AI-Assisted Custom Malware Suitecritical
- Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizationsmedium
- Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and…high
- Qilin Ransomware Gang Claims Breach of US ATF; Agency Confirms 'Major Incident' on Isolated Investigations…high
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KBhigh
- CameraSwarm Campaign Compromises 14,500 Dahua IP Cameras Across Ukraine and Russiahigh
- Password spraying attacks surge 155x as hackers exploit MFA gaps via Azure CLI / ROPC flowhigh
- Suspected China-Linked Actor Runs Near-Autonomous Multi-Agent AI Attack on Taiwan Government, Nuclear Safety…critical
- Azure Credential Theft Campaign Exposes Millions of Enterprise Records at McDonald's, Vodafone, TCShigh
- "TheHatman" Azure/Entra Directory Exfiltration Campaign Exposes Millions of Employee Records at McDonald's…high
- Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via…high
- Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defenderhigh
- Coldcard Hardware Wallet Firmware RNG Vulnerability (Yasmarang Fallback) Leads to ~$116M Bitcoin Theftcritical
- AnMed Health Ransomware/Malware Disruption Closes 79-83 South Carolina/Georgia Facilities, Extortion Note…high
- OAuth Client ID Spoofing Enables Silent Credential Validation Against Microsoft Entra ID — UNK_pyreq2323 &…high
- Check Point AI Security Report 2026: AI Shifts from Attack Tool to Autonomous Intrusion Operator (VoidLink…high
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…critical
- FortiBleed: Large-Scale Credential-Stuffing and Brute-Force Compromise of 73,932 Fortinet FortiGate SSL VPN…high
Detection coverage
Threadlinqs maintains 92 detection rules mapped to T1110.003 (SPL 31, KQL 39, Sigma 21, other 1). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1110 Brute Force — 175 tracked threats at the technique level.