Multi-key attack
Attacking many keys at once and settling for whichever falls first — which gets cheaper the more targets there are.
With an n-bit key, brute force costs 2n trials. If the attacker has the same known plaintext encrypted under 2k different keys, each guess can be checked against all ciphertexts at once, and the first hit arrives after roughly 2n−k trials. Eli Biham showed how this played out against DES in 2002, and Daniel J. Bernstein pointed out in 2005 that 128-bit keys in a world of billions of sessions leave less margin than the number suggests.
The remedies are longer keys and making sure identical plaintext isn't encrypted predictably. That is why TLS 1.3 mixes a derived secret into every nonce for AES-GCM: otherwise the predictable first record would hand the attacker a common target across every connection.