A large-scale cyber campaign attributed to an Iran-nexus threat actor is actively targeting Microsoft 365 environments, primarily in Israel and the United Arab Emirates.
The activity reflects a growing trend:
Cyber operations are increasingly used as geopolitical tools — blending espionage, disruption, and ransomware.
Scope of the campaign
According to security researchers, the campaign impacted:
- 🇮🇱 300+ organizations in Israel
- 🇦🇪 25+ organizations in the UAE
- Additional targets in:
- Europe
- United States
- United Kingdom
- Saudi Arabia
Targeted sectors include:
- Government and municipalities
- Technology companies
- Energy and transportation
- Private-sector organizations
Attack method: password spraying
The campaign relies on password spraying, a technique where attackers:
- Use common passwords
- Attempt to log in across many accounts
- Avoid triggering lockouts or rate limits
👉 This method is highly effective for identifying weak credentials at scale
Attack chain breakdown
The operation unfolds in three phases:
1. Scanning & spraying
- Conducted via Tor exit nodes
- High-volume login attempts
2. Authentication attempts
- Use of compromised or weak credentials
- Access to Microsoft 365 accounts
3. Data access & exfiltration
- Focus on mailbox data and sensitive information
Attribution indicators
The activity shows similarities to known Iranian groups, such as:
- Gray Sandstorm
- Peach Sandstorm
Key indicators include:
- Use of Tor infrastructure
- Commercial VPN services
- Red-team tools for stealth operations
Why this campaign matters
This attack is not just about credential theft.
It represents:
- State-aligned cyber activity
- Targeted intelligence gathering
- Potential preparation for follow-on attacks
👉 Microsoft 365 environments are especially attractive due to:
- Centralized access to communication
- Sensitive business data
- Identity and authentication systems
Parallel threat: Pay2Key ransomware returns
Alongside the password-spraying campaign, researchers observed renewed activity from:
👉 Pay2Key ransomware (Iran-linked)
Key developments:
- Targeted a U.S. healthcare organization
- Used legitimate tools like TeamViewer for access
- Disabled security controls (e.g., Microsoft Defender)
- Cleared logs after execution to erase evidence
Evolving capabilities:
- Improved evasion techniques
- Linux variant detected in the wild
- Faster encryption using ChaCha20
- Affiliate incentives increased (up to 80% ransom share)
A changing threat landscape
Iran-linked groups are increasingly:
- Combining espionage + ransomware
- Targeting geopolitical adversaries
- Leveraging cyberattacks as strategic retaliation
👉 This blurs the line between:
- Cybercrime
- State-sponsored operations
How to defend against these attacks
1. Enforce Multi-Factor Authentication (MFA)
Critical for all users — especially privileged accounts
2. Monitor sign-in logs
Look for:
- Multiple failed logins
- Geographic anomalies
- Tor or VPN-origin traffic
3. Apply Conditional Access policies
Restrict logins to approved regions and devices
4. Strengthen password policies
Eliminate weak and commonly used passwords
5. Enable audit logging
Essential for detecting and investigating breaches
Key takeaway
This campaign reinforces a critical reality:
Identity is the new attack surface.
With cloud services like Microsoft 365 at the center of operations, compromising credentials can be just as powerful as exploiting vulnerabilities.
