Brute-force attacks can be both online and offline. Online attacks target active systems, while offline attacks involve stolen password hashes. Cybercriminals often use specialized Brute-Force Attack Tools to automate and accelerate their efforts.