Yeah I've always wondered about these things, are they doing some kind of "brute force" attack, utilizing Zero days, or... what?
Seems like something nostr:nprofile1qyvhwumn8ghj7un9d3shjtnddakk7um5wg...
Like most cracking, it's not one thing and it's not guaranteed, but yes, brute force is an attack vector.