Loading story…
Password spraying has remained a persistent intrusion technique against cloud identity platforms, with CISA warning that attackers commonly target single sign-on, federated authentication, and email services by trying a small set of weak passwords across many accounts to avoid lockouts. U.S. authorities linked some activity to Iranian actors tied to the Mabna Institute, while Microsoft later reported that Iran-linked DEV-0343 sprayed passwords across more than 250 Office 365 tenants, focusing on defense, GIS, maritime, and cargo organizations; fewer than 20 tenants were compromised, and accounts protected by multifactor authentication were largely resistant.
More recent reporting shows the tactic evolving at scale. SecurityScorecard described a botnet of more than 130,000 compromised devices conducting password spraying against Microsoft 365 by abusing Basic Authentication in non-interactive sign-ins, using credentials from infostealer logs and infrastructure tentatively linked to a likely Chinese-affiliated group. Detection content from Splunk also highlighted Okta ThreatInsight alerts for suspected password-spray activity, underscoring that identity providers continue to surface this behavior in telemetry. Across the reporting, defenders are urged to enforce MFA, disable legacy and Basic Authentication where possible, strengthen password policies, and monitor sign-in logs for repeated failures, unusual user agents, and distributed login attempts from many IP addresses.
Get the actors, campaigns, and ATT&CK mapping behind it.
10 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection 'Okta ThreatInsight Suspected PasswordSpray Attack' from its content library in version 5.2.0 after updating detections to use new search logic and field names. The replacement detection was named 'Okta ThreatInsight Threat Detected.'
Based on server uptime analysis, SecurityScorecard assessed that a botnet of more than 130,000 compromised devices had likely been operating since December 2024. The botnet targeted Microsoft 365 accounts using non-interactive sign-ins with Basic Authentication and stolen credentials from infostealer logs.
Microsoft publicly reported that the Iran-linked DEV-0343 cluster had targeted more than 250 Office 365 tenants using password spraying and Tor-hosted infrastructure. The company said multifactor authentication protected Office 365 accounts from these attempts and published mitigation guidance.
Beginning in late July 2021, DEV-0343 conducted extensive password spraying against more than 250 Office 365 tenants, primarily targeting U.S. and Israeli defense technology firms, GIS organizations, Persian Gulf ports of entry, and maritime transportation companies. Microsoft said fewer than 20 tenants were successfully compromised.
Microsoft Threat Intelligence Center first observed and began tracking the DEV-0343 activity cluster in late July 2021. The cluster was later assessed as Iran-linked and associated with large-scale password spraying.
DHS and the FBI jointly released an alert describing password spraying as an increasingly common brute-force technique affecting organizations in the United States and abroad. The alert linked the activity pattern to FBI investigations involving Iranian nationals tied to the Mabna Institute, while noting the techniques were not unique to that group.
Microsoft published best practices for defending Azure AD and ADFS environments against password spray attacks. The reference identifies this as a defensive guidance publication rather than a specific intrusion disclosure.
In February 2018, the Department of Justice for the Southern District of New York indicted nine Iranian nationals associated with the Mabna Institute for computer intrusion offenses related to the password-spraying activity described in the alert.
SecurityScorecard reported a botnet of over 130,000 compromised devices conducting password spraying against Microsoft 365 accounts by abusing Basic Authentication in non-interactive sign-ins. The company tentatively attributed the activity to a likely Chinese-affiliated group and identified six suspected C2 servers.
SecurityScorecard said its initial investigation began after failed sign-in attempts were observed in the non-interactive sign-in logs of a Microsoft 365 tenant. The investigation led to identification of a large password-spraying botnet and six suspected command-and-control servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcemicrosoft.com
Open sourceired.team
Open sourceus-cert.cisa.gov
Open sourcemicrosoft.com
Open sourceus-cert.gov
Open sourceus-cert.gov
Open sourcesecurityscorecard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iran-linked threat actor conducted a password-spraying campaign against Microsoft 365 tenants, hitting more than 300 organizations in Israel and over 25 in the United Arab Emirates, with additional targeting in Europe, the United States, the United Kingdom, and Saudi Arabia. Check Point said the activity unfolded in three waves on March 3, 13, and 23 and primarily targeted municipalities, government bodies, energy and transportation organizations, technology firms, and other private-sector cloud environments. The attackers relied on weak passwords and exposed cloud accounts rather than malware or software exploits, using rotating Tor exit nodes and a spoofed Internet Explorer 10 on Windows 7 user agent during reconnaissance before shifting successful logins to commercial VPN infrastructure, including services associated with Windscribe and NordVPN, geolocated in Israel. Researchers said the intrusions led to access to email, documents, administrative tools, and in some cases mailbox data exfiltration. Check Point assessed the activity with moderate confidence as Iran-linked and noted similarities to **Gray Sandstorm**, while also tying parts of the infrastructure to `AS35758`, which has been associated with recent Iran-nexus operations. Israeli municipalities were identified as a primary focus, and the campaign may have supported broader operational objectives such as damage assessment tied to regional military activity. Defenders were urged to review sign-in logs for distributed authentication failures, enforce tenant-wide MFA, strengthen password policies, apply location-based access controls, block Tor where feasible, and retain audit logs for investigation.
Jun 29, 2026
Huntress reported a large password-spraying campaign targeting Microsoft Azure CLI by abusing the deprecated OAuth Resource Owner Password Credentials (ROPC) grant. During a two-week period in mid-June, the company observed more than **81 million** login attempts and **78** account compromises tied to traffic from an IPv6 range associated with hosting provider **LSHIY LLC**. When valid credentials were found, the attackers used a tenant’s `/token` endpoint to obtain user-delegated tokens, allowing access without triggering protections that organizations expected from multi-factor authentication and some Conditional Access configurations. The activity appeared opportunistic rather than focused on a specific sector, and Huntress said many affected organizations either lacked MFA or had Conditional Access policies scoped in ways that left some users exposed. After Huntress notified LSHIY, the provider said abuse of its bring-your-own-IP service had been terminated, but the actor later appeared to move to infrastructure linked to **FranTech** and **Tor** exit nodes. Huntress urged defenders to disable ROPC where possible, restrict Azure CLI use for non-admin users, enforce MFA and Conditional Access across all users and apps, and prioritize incident response based on whether sprayed credentials were valid rather than on spray volume alone.
Jul 30, 2026
A large-scale password spray campaign targeted Microsoft 365 environments through **Azure CLI** logins, generating more than **81 million authentication attempts** and compromising at least **78 accounts across 64 organizations**, according to Huntress. The attackers abused the deprecated OAuth **Resource Owner Password Credentials** (`ROPC`) flow to validate stolen username-password pairs and obtain user-delegated tokens, relying on previously breached credentials that had not been rotated. The activity was observed between mid and late June and in some cases succeeded even where **MFA** and **Conditional Access** were enabled, because policies were misconfigured or did not fully cover Azure CLI `ROPC` authentication. Huntress said most attempts originated from the IPv6 range `2a0a:d683::/32`, associated with **LSHIY LLC** (`AS32167`), and reported a more than **155-fold** increase in credential-spray volume across its customer base over six months. Defenders were urged to enforce MFA for all users, cloud apps, and client app types, and to restrict Azure CLI access for non-admin users.
Jul 12, 2026