I always asked myself this question: does this kind of attacks try to authenticate to every single IP address (for loop, excluding ranges from Google, Microsoft, Apple...) or does it penetrate the victim network first by executing some random file from the internet that the victim downloaded?