Iran-Linked Threat Actor Targets Middle East Cloud Environments with Password Spraying

An advanced cyber campaign targeted the cloud environments of over 300 organizations in Israel, the UAE, and other regions. Attackers systematically guessed passwords across many accounts to break into Microsoft 365 systems and steal sensitive information.

Security researchers assess with moderate confidence that the attackers are an Iran-linked threat group. Their methods and use of specific tools closely resemble those of known advanced Iranian cyber actors, specifically the group tracked as "Gray Sandstorm."

The primary goal was to steal valid login credentials to infiltrate systems and read personal emails. Researchers believe this data gathering was intended to assess physical damage and support physical missile strikes that were happening concurrently in the region.

The campaign was widespread and intense, striking in three distinct waves during March. It heavily impacted over 300 organizations in Israel and more than 25 in the United Arab Emirates, with a smaller number of targets located in Europe, the US, the UK, and Saudi Arabia.

Yes, the attackers heavily focused on local municipalities, alongside the energy sector, private companies, aviation, maritime, and satellite organizations. Municipalities were likely prioritized due to their critical role in managing emergency responses to physical missile damage.

The attackers used automated tools to guess common passwords across hundreds of accounts while hiding their network traffic through anonymity services. Once they guessed a correct password, they used virtual private networks (VPNs) to make it appear as though they were logging in locally, allowing them to bypass security blocks and quietly steal email data.

Organizations like local governments and energy providers hold critical infrastructure data and sensitive internal communications. During a physical conflict, accessing these systems provides attackers with highly valuable intelligence on emergency responses, infrastructure status, and municipal communications.

While the password-guessing technique itself is a broad approach, the campaign's focus was highly targeted both geographically and sectorally. It specifically zeroed in on Middle Eastern municipal and critical infrastructure sectors to align with kinetic conflict objectives.