Password spraying
Security incidents tagged Password spraying. Newest first.
0 Password spraying incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 1014
- Longest quiet run: 933 days (Apr 3–Oct 22)
Show 1 older incident1 older incident
January 2024 1
HighMidnight Blizzard breaches Microsoft corporate emailNo fix needed
Microsoft corporate email (Microsoft 365) No fix needed
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
