{"id":231961,"date":"2026-04-06T14:37:00","date_gmt":"2026-04-06T18:37:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/06\/iran-linked-password-spraying-campaign-targets-300-israeli-microsoft-365-organizations\/"},"modified":"2026-04-06T21:00:12","modified_gmt":"2026-04-07T01:00:12","slug":"iran-linked-password-spraying-campaign-targets-300-israeli-microsoft-365-organizations","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/06\/iran-linked-password-spraying-campaign-targets-300-israeli-microsoft-365-organizations\/","title":{"rendered":"Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations"},"content":{"rendered":"

Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/04\/iran-linked-password-spraying-campaign.html<\/a><\/p>\n

Publish Date: 2026-04-06 14:37:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

An\u00a0Iran-nexus threat actor is suspected to be behind a password-spraying campaign targeting Microsoft 365 environments in Israel and the U.A.E. amid\u00a0ongoing conflict in the Middle\u00a0East.<\/p>\n

The\u00a0activity, assessed to be ongoing, was carried out in three distinct attack waves that took place on March 3, March 13, and March 23, 2026, per Check\u00a0Point.<\/p>\n

“The campaign is primarily focused on Israel and the U.A.E., impacting more than 300 organizations in Israel and over 25 in the U.A.E.,” the Israeli cybersecurity\u00a0company said. “Activity associated with the same actor was also observed against a limited number of targets in Europe, the United States, the United Kingdom, and Saudi\u00a0Arabia.”<\/p>\n

The\u00a0campaign is assessed to have targeted the cloud environments of government entities, municipalities, technology, transportation, energy sector organizations, and private-sector companies in the\u00a0region.<\/p>\n

Password spraying is a form of brute-force attack where a threat actor attempts to use a single common password against multiple usernames on the same application. It’s also considered a more effective way to discover weak credentials at scale without triggering rate-limiting\u00a0defenses.<\/p>\n

Check\u00a0Point said the technique is known\u00a0to be adopted by Iranian hacking groups\u00a0like Peach\u00a0Sandstorm\u00a0and Gray\u00a0Sandstorm (formerly DEV-0343) in the past to infiltrate target\u00a0networks.<\/p>\n

The\u00a0campaign essentially unfolds over three phases: aggressive scanning or password-spraying conducted from Tor exit nodes, followed by conducting the login process, and exfiltrating sensitive data, such as mailbox\u00a0content.\u00a0<\/p>\n

“Analysis of M365 logs suggests similarities\u00a0to Gray\u00a0Sandstorm, including the use of red-team tools to conduct these attacks via Tor exit nodes,” Check Point said. “The threat actor used commercial VPN nodes hosted at AS35758 (Rachamim Aviel Twito), which aligns with recent activity tied to Iran-nexus operations in the Middle\u00a0East.”<\/p>\n

\"\"<\/p>\n

To\u00a0counter the threat, organizations are…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations https:\/\/thehackernews.com\/2026\/04\/iran-linked-password-spraying-campaign.html Publish Date: 2026-04-06 14:37:00 Source…<\/p>\n","protected":false},"author":1,"featured_media":231962,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjgf4g-Zhhi4P6IHkSqUlU3EzCQNKPJ1nV3mWfQAtS6gfGu6H7wuq5OgVXGvF1IM2afayopX3b0zj4bjVDYaO7dBc4rl0A0Y6GND1VkbLdug_ULVW6a6P7iNlhUFGwMsRSDHqbodsc8EeLcg2nXxDPXO0h8RABu_jr9o-5cx8g5GTXxFgDOx9PTRQIFECpL\/s1600\/iran.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,34],"class_list":["post-231961","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231961"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=231961"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231961\/revisions"}],"predecessor-version":[{"id":231963,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231961\/revisions\/231963"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/231962"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=231961"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=231961"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=231961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}