Security News > 2023 > September > Iranian hackers breach defense orgs in password spray attacks

Microsoft says an Iranian-backed threat group has targeted thousands of organizations in the U.S. and worldwide in password spray attacks since February 2023.

"Between February and July 2023, Peach Sandstorm carried out a wave of password spray attacks attempting to authenticate to thousands of environments," the Microsoft Threat Intelligence team said.

In password spray attacks, threat actors try to log in to many accounts using a single password or a list of commonly employed passwords.

As Microsoft's Identity Security Director, Alex Weinert, said three years ago, password spray attacks are among the most popular authentication attacks, amounting to more than a third of enterprise account compromises.

In July 2021, the NSA said the Russian APT28 military hacking group targeted the U.S. government and Department of Defense agencies in password spray attacks launched from Kubernetes clusters.

Months later, in October 2021, Microsoft also spotted the Iran-linked DEV-0343 and the Russian-sponsored Nobelium groups breaching defense tech companies and managed service providers in password spray attacks.

News URL

https://www.bleepingcomputer.com/news/security/iranian-hackers-breach-defense-orgs-in-password-spray-attacks/