The lifecycle of an RDP brute-force attack using tools like Z668 generally follows a four-step process:
Compromised servers are often turned into "bots" for DDoS attacks or used for clandestine cryptocurrency mining. Defensive Best Practices
High efficiency in processing large IP lists.