As cited
Copy frozen at (site build).
threat intel
Risky Bulletin: Iranian password sprays came first, then came the missiles
A suspected Iranian advanced persistent threat (APT) group conducted a password spray attack against Microsoft 365 accounts of government and private sector organizations in the Middle East starting in early March. The campaign targeted Israeli and UAE municipalities that were subsequently struck by Iranian drone and missile attacks, suggesting a reconnaissance phase preceding kinetic operations.
Why it matters: Security teams managing Microsoft 365 environments in the Middle East and those defending government, military, or critical infrastructure sectors need to review account access logs from early March 2025 for signs of compromise and strengthen authentication controls, as this activity precedes direct military action.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: Iranian password sprays came first, then came the missiles
A suspected Iranian APT group conducted password spray attacks against Microsoft 365 accounts of government and private sector organizations across the Middle East in early March. The campaign targeted Israeli and UAE municipalities that were subsequently struck by Iranian drone and missile attacks, according to Check Point researchers. The timing coincided with Iran's military response following the deaths of senior Iranian officials in late February.
Why it matters: Security teams at government agencies, municipalities, and organizations in the Middle East should review Microsoft 365 access logs for early March for signs of credential compromise, especially if located in Israel or the UAE, as this campaign preceded kinetic strikes.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: Iranian password sprays came first, then came the missiles
A suspected Iranian APT group conducted password spray attacks against Microsoft 365 accounts of government and private sector organizations across the Middle East in early March. The campaign targeted Israeli and UAE municipalities that were subsequently struck by Iranian drone and missile attacks, according to Check Point researchers. The timing coincided with Iran's military response following the deaths of senior Iranian officials in late February.
Why it matters: Security teams at government agencies, municipalities, and organizations in the Middle East should review Microsoft 365 access logs for early March for signs of credential compromise, especially if located in Israel or the UAE, as this campaign preceded kinetic strikes.
- Source published
- First seen by Cybersecurity Tracker