Multi-target attack
Going after many keys at once and settling for whichever one breaks first, which makes exhaustive search cheaper.
Searching a 128-bit key space takes 2127 trials on average. If the attacker has the same known plaintext encrypted under 240 different keys, around 288 trials are enough to hit one of them, because each guess is checked against the whole collection at once. Eli Biham demonstrated the principle against DES in 1996, and Daniel J. Bernstein made a point in 2005 of how rarely security margins account for it.
This is why TLS 1.3 doesn't use bare sequence numbers as AES-GCM nonces but XORs them with a secret per-connection IV. Bellare and Tackmann analysed exactly that detail in 2016. The other defences are boring: longer keys, or making sure different users never encrypt the same predictable block.