Iran Targets M365 Accounts with Password-Spraying Attacks
Basically, Iran is trying to guess passwords to access Microsoft accounts.
Iran-linked hackers are targeting Microsoft 365 accounts with password-spraying attacks. Over 300 organizations in Israel and the UAE are impacted. This raises significant security concerns as attackers aim to steal sensitive information.
The Threat
Recent reports indicate that Iran-linked threat actors are launching password-spraying attacks against Microsoft 365 accounts. These attacks have primarily targeted over 300 organizations in Israel and more than 25 in the United Arab Emirates. Researchers from Check Point believe these campaigns may serve a dual purpose: to gather intelligence and support bomb damage assessments following missile strikes in these regions. The attackers are leveraging multiple IP addresses to mask their activities, making it difficult to trace their origins.
Who's Behind It
The attackers are suspected to be affiliated with Iranian military groups, particularly the Islamic Revolutionary Guard Corps. Notable groups involved include Peach Sandstorm and Gray Sandstorm, both of which have a history of using password-spraying techniques for initial access. The attacks occurred in three distinct waves on March 3, 13, and 23, showcasing a coordinated effort to infiltrate various sectors, including technology, healthcare, and transportation.
Tactics & Techniques
The method employed in these attacks involves password spraying, where attackers attempt to log in to numerous accounts using a small set of commonly used passwords. They utilize Tor exit nodes and disguise their User-Agent to appear as Internet Explorer 10, which helps them avoid detection. Once they successfully guess a password, they log in from various VPN IP addresses geolocated in Israel, allowing them to access sensitive information, including personal emails and communications.
Defensive Measures
Organizations, especially those in the targeted sectors, should implement multi-factor authentication (MFA) to enhance security. Regularly updating passwords and educating employees about strong password practices can also mitigate risks. Monitoring for unusual login attempts and employing advanced threat detection tools can help identify potential breaches early. Given the geopolitical context, staying vigilant against further attacks from Iranian threat actors is crucial for maintaining cybersecurity resilience.