THREAT ALERT
M365 Password Spraying Attack via Botnet
Thursday, February 27th, 2025
THREAT ALERT
Thursday, February 27th, 2025
Microsoft 365 accounts are facing an extensive password spraying attack by a Chinese botnet, which possesses the ability to bypass multifactor authentication (MFA). This botnet comprises over 130,000 compromised devices, utilizing stolen credentials from infostealer accounts and then systematically attempting to log into M365 accounts globally.
Microsoft 365 accounts are facing an extensive password spraying attack by a Chinese botnet, which possesses the ability to bypass multifactor authentication (MFA). This botnet comprises over 130,000 compromised devices, utilizing stolen credentials from infostealer accounts and then systematically attempting to log into M365 accounts globally. Malicious actors gaining access to M365 accounts can be highly detrimental to an organization for numerous reasons. Once access is obtained, cybercriminals can freely access sensitive information such as emails and data. This also enables them to move laterally within the network and can also include internal phishing campaigns. Business disruptions can also occur due to repeated failed logins.
As previously mentioned, this botnet can bypass MFA and potentially Conditional Access Policies (CAP) by causing login events to be logged in the Non-Interactive Sign-in logs. Non-Interactive Sign-in logs capture sign-ins performed by Operating Systems components or Client Applications on behalf of the users. These sign-ins often do not require MFA, and many configurations did not trigger MFA for the sign-ins. Consequently, if an organization only monitors interactive sign-ins, these attacks will go unnoticed because they are recorded in Non-Interactive Sign-in logs. The botnet also leverages command-and-control (C2) servers hosted in SharkTech. This is a US-based provider that, in the past, has been observed hosting malicious activity. The time zone showing for the servers is configured for “Asia/Shanghai”, leading to the belief that these attacks are being conducted by a Chinese-affiliated group.
Combat the problem
Below you will find a list of recommendations to help detect and mitigate the password spraying campaign. Please note, this is not an exhaustive list of recommendations, and you should also refer to your internal policies and procedure for guidance.
DefenseStorm Recommendations
As always, DefenseStorm recommends the following practices to help secure your environment:
Desrah Kraft
Cyber Threat Intelligence Engineer
Desrah Kraft is a Cyber Threat Intelligence Engineer at DefenseStorm. For the past three years, she has played a vital role in leading and contributing to various Incident Response efforts. Before transitioning into cybersecurity, Desrah obtained a bachelor’s degree from Mitchell College and worked for 7 years in law enforcement. This experience helped her cultivate a comprehensive understanding of security principles and investigative practices. An accomplished cybersecurity professional with 4 years of hands-on experience in analyzing malware and extensive expertise in safeguarding digital landscapes against malicious threats, Desrah possesses an unparalleled ability to dissect complex cyber threats, identify their origins, and implement effective countermeasures. Additionally, she holds multiple MITRE certifications, which demonstrate her mastery of advanced threat detection and mitigation techniques. Recognized for her keen eye for anomalies and proactive approach, Desrah excels in Endpoint Detection and Response (EDR), enabling rapid identification, investigation, and containment of potential breaches. Committed to continuous growth and learning, Desrah remains at the forefront of cybersecurity, dedicated to fortifying digital infrastructures and inspiring others in the field.