Loading malware…
NLBrute is a Windows brute-force utility used by intruders to automate password-guessing attacks against Remote Desktop Protocol services. It appears in multiple intrusion sets as an operator tool rather than a self-propagating malware family, and has been observed in hands-on-keyboard ransomware and post-compromise operations. Documented use includes attempts to break into internet-exposed RDP systems with supplied username and password lists, support for follow-on movement through compromised environments, and use alongside credential-dumping, remote administration, scanning, and proxy tools.
NLBrute has been associated with opportunistic and enterprise-targeting activity, including PARINACOTA-linked ransomware operations, intrusions preceding LockBit deployment, and tooling recovered from Netwalker-related campaigns. In these cases, operators used it to brute-force RDP-enabled machines, sometimes after initial compromise and sometimes as part of broader lateral movement. Its role is consistent with credential-access and remote-access expansion in environments where weak passwords and exposed RDP services are present.
The tool targets Windows environments because it is used against Windows RDP infrastructure and has been recovered from Windows-centric attacker toolsets. High-confidence reporting supports its use for brute-force access attempts and movement within victim networks, but not more specialized capabilities beyond password guessing against remote services.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used by the attackers during post-compromise activity to move through the network.
Brute-force/proxy tool installed by the attackers to support password attacks and access expansion inside the victim network.
Password brute-force utility used against RDP for initial access and/or lateral movement within victim networks.
Tool used to brute-force RDP credentials during initial access in PARINACOTA activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.