← Threat archive

T1110.004 Brute Force: Credential Stuffing

2 threats tracked by Spectrum Delta use this technique.

T1110.004 on MITRE ATT&CK →

  • n0n credential extortion

    Credential stuffing against FortiGate SSL-VPN through residential proxies

    FortiGate SSL-VPN event logs (authentication attempts); HTTP-header capture only for the cookie

    Seen in: FortiGate SSL-VPN events

  • ARTEX Okta/Entra spray campaign

    Credential guessing via account-recovery abuse

    AWS Cognito events: InitiateAuth/ForgotPassword/ResendConfirmationCode bursts and SignUp attempts with rotating user agents; HTTP access logs: reset/activation/reset-token endpoint sequences and username-existence checks

    Seen in: AWS Cognito events, Web / HTTP access logs