PASSWORD-SPRAYING ATTACKS TARGET 80K MICROSOFT ENTRA ID ACCOUNTS

Summary from the TLDR InfoSec newsletter

Researchers at Proofpoint are warning of a password-spraying attack targeting Microsoft Entra ID accounts by a threat actor called UNK_SneakyStrike. The researchers said the peak of the activity occurred on January 8, when 16.5K accounts were targeted in a single day, but the attacks have continued in short bursts since then. Proofpoint identified that the attackers were using the TeamFiltration pentesting framework based on a unique user agent that it uses and other artifacts.