- A new password spraying attack was recently observed
- It targets organizations and M365 accounts in the West
- The attack focuses on Non-Interactive Sign-Ins
Hackers, possibly of Chinese affiliation, are targeting organizations in the west with a large-scale password spraying attack, experts have claimed.
A report from cybersecurity researchers SecurityScorecard says businesses relying on Microsoft 365 office software for email, document storage, and collaboration, are at particular risk.
SecurityScorecard said it has found evidence of “China-affiliated threat actors” using infrastructure “tied to” CDS Global Cloud and UCLOUD HK, providers with “operational ties” to China. The researchers also said they saw servers hosted in SharkTech being used for the campaign’s C2. SharkTech is allegedly a US-based provider that’s hosted malicious activity in the past.
Microsoft 365 targeted by attacks
Password spraying is hardly new, but there are things that make this campaign stand out as notably dangerous, such as leveraging non-interactive sign-ins. This helps the attackers avoid being detected by traditional security controls.
“Typically, password spraying results in lockouts that alert security teams,” the researchers explain. “However, this campaign specifically targets Non-Interactive Sign-Ins, used for service-to-service authentication, which do not always generate security alerts. This enables attackers to operate without triggering MFA defenses or Conditional Access Policies (CAP), even in highly secured environments.”
The attackers are going for Microsoft 365 accounts, SecurityScorecard further stressed, mostly in organizations in financial services and insurance. However, healthcare, government and defense, technology and SaaS, and education and research, are also major targets.
The researchers believe the attack matters because it is bypassing modern defences, and it is probably the doing of the Chinese government. As such, organizations in the west should be particularly careful, reviewing non-interactive sign-in logs for unauthorized access attempts, rotate credentials for any flagged accounts, and disable legacy authentication protocols. Furthermore, they should monitor for stolen credentials linked to their organizations, and implement conditional access policies.
“These findings from our STRIKE Threat Intelligence team reinforce how adversaries continue to find and exploit gaps in authentication processes,” said David Mound, Threat Intelligence Researcher at SecurityScorecard. “Organizations cannot afford to assume that MFA alone is a sufficient defense. Understanding the nuances of non-interactive logins is crucial to closing these gaps.”