Iran targets M365 accounts with password-spraying attacks

[littlemissmartypants]

Tue 31 Mar 2026 // 19:09 UTC

Suspected Iran-linked threat actors are conducting password-spraying attacks against hundreds of organizations, primarily Middle Eastern municipalities, in campaigns that security researchers believe may have been aimed at supporting bomb-damage assessment following missile strikes.

Tel Aviv-based Check Point Research on Tuesday said that the attackers used multiple source IP addresses to target numerous Microsoft 365 accounts, affecting more than 300 organizations in Israel and more than 25 in the United Arab Emirates. While most of the password spraying hit these two Middle Eastern countries, the researchers tracked similar activity from the same attacker against a "limited number" of targets in the US, Europe, and Saudi Arabia.

The attacks happened in three waves - March 3, March 13, and March 23 - and Iran-linked groups, including the Islamic Revolutionary Guard Corps' Peach Sandstorm and Gray Sandstorm, are known to use this method to gain initial access to victims' Microsoft 365 environments and steal sensitive information.

While Israel's municipal sector bore the brunt of the password-spraying attacks, other industries, including technology (63 attempts), transportation and logistics (32), healthcare (28), and manufacturing (28), were also targeted.
...
https://www.theregister.com/2026/03/31/iran_password_spraying_m365/?utm_source=dlvr.it&utm_medium=bluesky

[GreatGazoo]

1. Had to look it up

password-spraying is trying the same commonly used or likely password on every known account. This avoids lock outs because each account is tried only once.

[Wonder Why]

2. If you're that stupid, you should join trump's administration.

[littlemissmartypants]

3. And how stupid is that? And who's being stupid? I don't understand your reply, Wonder Why.

Please elaborate. Thank you. ❤️

[Wonder Why]

4. People who have "the same commonly used or likely password".

Instead of hitting one account with multiple attempts to try different passwords to crack it, which would cause the account to be locked because of multiple failures, they try one common password like the word "password" on zillions of different accounts to find the idiots that were that stupid. Such people are just begging to get hacked.

You'd be amazed at the number of people that just use successive keys (qwerty) on keyboard or Password123 which has upper/lower case and numbers but is all too common e.g.

When you have an account that is open to the internet, anyone can try a simple password on it and if 1 billion people have a Microsoft 365, one try on each of those billion by a computer program, is bound to find the idiots in no time at all.

[littlemissmartypants]

5. Excellent clarification. I think it leaves a much deeper impression. TY❤️

[Wonder Why]

6. A better one might be an apartment complex where every apartment has a digital lock that requires you have a 6 digital c

Go to each successively and try 123456 and see how many doors that it opens. You would be amazed. Trying 3 failed codes on one door might set off an alarm but one "mistake" on every door will never be noticed.

[littlemissmartypants]

7. I think that they are both very good, WW. They each may appeal differently to different individual groups of people. ...

The expanded examples make the descriptions available to an expanded audience.

The article is geared towards a very specific group, and your explanations make it meaningful to many people who otherwise would not see the personal relevance.

Thanks again! ❤️