Loading story…
An Iran-linked threat actor conducted a password-spraying campaign against Microsoft 365 tenants, hitting more than 300 organizations in Israel and over 25 in the United Arab Emirates, with additional targeting in Europe, the United States, the United Kingdom, and Saudi Arabia. Check Point said the activity unfolded in three waves on March 3, 13, and 23 and primarily targeted municipalities, government bodies, energy and transportation organizations, technology firms, and other private-sector cloud environments. The attackers relied on weak passwords and exposed cloud accounts rather than malware or software exploits, using rotating Tor exit nodes and a spoofed Internet Explorer 10 on Windows 7 user agent during reconnaissance before shifting successful logins to commercial VPN infrastructure, including services associated with Windscribe and NordVPN, geolocated in Israel.
Researchers said the intrusions led to access to email, documents, administrative tools, and in some cases mailbox data exfiltration. Check Point assessed the activity with moderate confidence as Iran-linked and noted similarities to Gray Sandstorm, while also tying parts of the infrastructure to AS35758, which has been associated with recent Iran-nexus operations. Israeli municipalities were identified as a primary focus, and the campaign may have supported broader operational objectives such as damage assessment tied to regional military activity. Defenders were urged to review sign-in logs for distributed authentication failures, enforce tenant-wide MFA, strengthen password policies, apply location-based access controls, block Tor where feasible, and retain audit logs for investigation.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
By April 2026, Check Point publicly reported the March password-spraying campaign and said it affected more than 300 organizations in Israel and over 25 in the UAE. The company assessed with moderate confidence that the activity was linked to an Iran-origin actor, noting similarities to Gray Sandstorm and infrastructure associated with recent Iran-nexus operations.
On March 23, 2026, a third wave of the campaign was recorded, continuing attacks against organizations in Israel and the UAE with limited additional targeting in Europe, the United States, the United Kingdom, and Saudi Arabia. After successful authentication, the actor shifted from Tor-based reconnaissance to commercial VPN infrastructure and conducted mailbox data exfiltration.
On March 13, 2026, researchers observed a second wave in the same password-spraying campaign. The activity continued to focus on Microsoft 365 tenants, especially municipalities, government entities, energy organizations, and private companies in Israel and the UAE.
On March 3, 2026, an Iran-linked threat actor launched the first observed wave of password-spraying attacks against Microsoft 365 environments. The campaign primarily targeted organizations in Israel and the United Arab Emirates, using Tor exit nodes to attempt logins against exposed cloud accounts.
In late February 2026, the Iranian ransomware group Pay2Key targeted a U.S. healthcare organization using an updated ransomware variant with stronger evasion and anti-forensics features. Researchers said the intrusion involved a legitimate remote access tool, defense disabling, recovery inhibition, ransomware deployment, and log clearing, with no data exfiltration observed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Password spraying has remained a persistent intrusion technique against cloud identity platforms, with CISA warning that attackers commonly target **single sign-on**, federated authentication, and email services by trying a small set of weak passwords across many accounts to avoid lockouts. U.S. authorities linked some activity to Iranian actors tied to the Mabna Institute, while Microsoft later reported that Iran-linked **DEV-0343** sprayed passwords across more than 250 Office 365 tenants, focusing on defense, GIS, maritime, and cargo organizations; fewer than 20 tenants were compromised, and accounts protected by **multifactor authentication** were largely resistant. More recent reporting shows the tactic evolving at scale. SecurityScorecard described a botnet of more than **130,000** compromised devices conducting password spraying against **Microsoft 365** by abusing **Basic Authentication** in non-interactive sign-ins, using credentials from infostealer logs and infrastructure tentatively linked to a likely Chinese-affiliated group. Detection content from Splunk also highlighted **Okta ThreatInsight** alerts for suspected password-spray activity, underscoring that identity providers continue to surface this behavior in telemetry. Across the reporting, defenders are urged to enforce MFA, disable legacy and Basic Authentication where possible, strengthen password policies, and monitor sign-in logs for repeated failures, unusual user agents, and distributed login attempts from many IP addresses.
Aug 15, 2026
Iran-nexus cyber activity intensified alongside regional military escalation, with multiple reporting streams describing both opportunistic and targeted operations. Check Point Research observed a coordinated campaign to compromise internet-connected **IP cameras** across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus, with spikes in exploitation attempts aligning to geopolitical events; activity was traced to infrastructure linked to Iran-nexus actors using commercial VPN exit nodes (e.g., *Mullvad*, *ProtonVPN*, *Surfshark*, *NordVPN*) and VPS infrastructure to mask origin, and the most targeted vendors were **Hikvision** and **Dahua**. Separately, Symantec reported **Seedworm** (*MuddyWater/Temp Zagros/Static Kitten*) activity on multiple U.S. and Canadian organizations beginning in February 2026, including a U.S. bank, airport, non-profit, and the Israeli operations of a U.S. software supplier to defense/aerospace; Symantec identified a previously unknown backdoor dubbed **Dindoor** (leveraging the *Deno* runtime) and a Python backdoor **Fakeset**, with malware signed using certificates issued to “**Amy Cherne**” (and in some cases “**Donald Gay**”), and noted attempted data exfiltration using **Rclone** to a *Wasabi* cloud storage bucket. Additional coverage indicates broader pro-Iranian cyber activity but is less specific to the above intrusions. ASEC’s weekly “Ransom & Dark Web Issues” roundup flags **pro-Iranian/pro-Islamist hacktivist** attacks against Middle Eastern and pro-Western targets, but provides limited technical detail in the excerpt. A podcast episode describing “Iran’s 12 days of cyber war” and global OT targeting (including *Unitronics* PLCs) is largely commentary and retrospective framing rather than a discrete, verifiable incident report, and two other items in the set (a Russia-linked **APT28** phishing/malware campaign in Ukraine and a China-nexus **UAT-9244** telecom intrusion set in South America) describe unrelated threat activity outside the Iran-focused escalation.
Jul 22, 2026
Huntress reported a large password-spraying campaign targeting Microsoft Azure CLI by abusing the deprecated OAuth Resource Owner Password Credentials (ROPC) grant. During a two-week period in mid-June, the company observed more than **81 million** login attempts and **78** account compromises tied to traffic from an IPv6 range associated with hosting provider **LSHIY LLC**. When valid credentials were found, the attackers used a tenant’s `/token` endpoint to obtain user-delegated tokens, allowing access without triggering protections that organizations expected from multi-factor authentication and some Conditional Access configurations. The activity appeared opportunistic rather than focused on a specific sector, and Huntress said many affected organizations either lacked MFA or had Conditional Access policies scoped in ways that left some users exposed. After Huntress notified LSHIY, the provider said abuse of its bring-your-own-IP service had been terminated, but the actor later appeared to move to infrastructure linked to **FranTech** and **Tor** exit nodes. Huntress urged defenders to disable ROPC where possible, restrict Azure CLI use for non-admin users, enforce MFA and Conditional Access across all users and apps, and prioritize incident response based on whether sprayed credentials were valid rather than on spray volume alone.
Jul 30, 2026