It has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. It has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.