The attacks, which were identified by South Korean cyber security organisation AhnLab, discovered that threat actors were using brute-force or dictionary attacks with obtained or guessed credentials to infiltrate externally accessible MS-SQL servers.