理解密码喷洒（password spraying）攻击

Attack type

Password spraying (low-and-slow brute force across many accounts)

Impact level

High

Target

SSO/IdP portals, VPN/VDI, SaaS sign-ins, exec/admin users, service accounts

Primary attack vector

Automated login attempts using common/default passwords + OSINT usernames

Motivation

Initial foothold, ATO for fraud/exfiltration, staging for lateral movement/ransomware

Common prevention methods

Phishing-resistant MFA, lockout/rate limits, banned password lists, disable legacy auth, bot/CAPTCHA, CA policies

Potential damage

High

Ease of execution

Medium–High

Likelihood

High

Targets

Single account or a few

Many accounts

Many accounts

Method

Attempts many possible passwords for the same account (often automated, exhaustive)

Uses leaked/stolen credentials obtained from breaches and replays them across services to find reused or valid logins

Tries a few common passwords across many accounts to avoid lockouts

Lockout profile

High risk of lockout on targeted account

May trigger protection if credentials are wrong or reused

Designed to avoid per-account lockout by spreading attempts

Chance of success

Can succeed if no lockouts and password is weak

High if users reuse breached passwords

Effective against organizations with many weak/default passwords and relaxed login limits

Microsoft (2024)

In January 2024, Microsoft disclosed that beginning late November 2023, a nation-state actor (Midnight Blizzard, also known as APT29/NOBELIUM) used a password spray attack to compromise a legacy non-production test tenant account, one that lacked MFA.

Using that foothold, the attacker gained access to a very small percentage of Microsoft’s corporate email accounts, including senior leadership, cybersecurity, legal, and other functions. They then exfiltrated emails and attachments from some of those mailboxes, exposing high-value communications.

Citrix (2019)

In March 2019, Citrix announced that the FBI had alerted them to a likely password spraying attack by international cybercriminals. By July, Citrix confirmed that attackers had indeed gained access to its internal network using this method. The attackers accessed a shared network drive storing business documents and a web-tool consulting drive between October 2018 and March 2019.

The compromise went undetected for months, during which attackers accessed files containing sensitive personal information of employees, including names, social security numbers, and financial data. Approximately 24,000 individuals were affected, including current and former employees, interns, job candidates, contractors, and beneficiaries. The breach resulted in a class-action lawsuit that led to a $2.275 million settlement to provide victims with credit monitoring and identity theft recovery services. It also led to regulatory scrutiny and reputational damage.

Peach Sandstorm (2023)

Starting February 2023, Peach Sandstorm (an Iranian state-backed threat group) launched a series of password spraying campaigns targeting the defense, satellite, and pharmaceutical sectors in the United States, Saudi Arabia, South Korea, Australia, and the United Arab Emirates. According to Microsoft, the group used anonymized infrastructure, including Tor networks, to hide their activity while attempting to compromise many accounts with common passwords. Once successful, the attackers established persistent access, enabling long-term cyber-espionage and intelligence collection within high-value environments.

Financial

Organizations face direct financial losses from fraudulent transactions, unauthorized fund transfers, and incident response efforts including forensic investigations and system remediation. Regulatory fines under frameworks like GDPR and HIPAA can reach millions of dollars, while cyber insurance premiums can increase. Publicly traded companies can also be hit by stock price volatility and loss of market capitalization.

Operational

The operational impact of password spraying ripples through an organization. Emergency measures such as forced account lockouts and password resets can temporarily halt business operations. During investigations and recovery, critical services may experience downtime, and employees can lose productive work hours. All this adversely affects efficiency and revenue.

Reputational

Public disclosure of a breach erodes customer trust, leading to customer attrition and difficulty in acquiring new clients. Media coverage amplifies the damage by keeping security failures in the public eye. Partner organizations tend to reconsider business relationships due to loss of brand credibility.

Legal/regulatory

Attacks that result in data breaches trigger legal and regulatory consequences. Organizations must meet breach notification requirements, with missed deadlines resulting in penalties. Regulators investigate whether proper security controls were in place, from HIPAA in healthcare to SOX, PCI-DSS, and GDPR in finance and data protection. These incidents can also spark class-action lawsuits for breach of privacy. Contracts with business partners can stand violated, resulting in liability for partner losses.

Organizations with externally facing authentication services

Organizations that expose authentication services to the internet are prime targets. Common attack surfaces include:

• VPN gateways
• Email portals like Outlook Web Access and Microsoft 365/Entra ID
• Cloud applications such as Google Workspace and Salesforce

Single sign-on (SSO) and federated identity systems like AD FS, Okta, and Ping Identity are high-value entry points for credential-based attacks. By compromising them, attackers gain access to multiple internal and third-party apps simultaneously.

Industries handling sensitive data

Sectors that store or process confidential or regulated information are especially appealing to threat actors due to the high value of the data.

• Healthcare organizations are targeted for patient data and access to electronic health records systems containing HIPAA-protected data.
• Financial institutions face risks to online banking platforms, trading applications, and payment processing systems.
• Government and defense entities are prime espionage targets due to classified data, extensive contractor networks, and citizen service portals.
• At educational institutions, student information systems often use predictable username formats based on student names. Combined with less mature security controls, this makes it easier for attackers to generate valid credential lists for password spraying campaigns.

Users with high-value or privileged accounts

Attackers love to go after accounts that provide administrative access or financial control.

• C-suite executives and board members are valuable because their accounts contain sensitive communications and strategic information.
• IT administrators control identity systems, servers, and cloud environments, making them highly valuable targets.
• Finance and payroll staff are targeted for potential fraud in payroll processing and wire-transfer manipulation.
• Service accounts, which have broad access but weaker monitoring, are another common entry point.

Accounts with weak or default credentials

New or forgotten employee accounts with default passwords are low-hanging fruit. Even active users who follow common, predictable password patterns (like CompanyName2025!) pose a risk. Legacy or inactive accounts that remain enabled in the directory are also dangerous, as they are rarely monitored yet may still provide valid access.

Cloud and remote work environments

With remote work and cloud adoption, many employees log in through VPNs, VDIs, or SSO platforms. This creates a large attack surface, where one compromised password can open access to dozens of connected systems.

Potential damage

High
A single successful compromise can lead to mailbox takeover, theft of sensitive documents, business email compromise, lateral movement into critical systems, and even ransomware staging. If the compromised account has elevated privileges or access to SSO, the impact multiplies.

Ease of execution

Medium–High
Password spraying requires relatively little skill. Commodity tooling, public wordlists of common passwords, automated scripts, and basic OSINT to harvest usernames are enough to launch an attack. Threat actors can scale using simple automation and proxy services. Hence, carrying out the attack is not trivial but within reach of many threat actors.

Likelihood

High
The password spraying technique is cheap, effective, and widely used in attacks. Automated campaigns and botnets make it easy to target many victims quickly. Because many organizations still have weak or reused passwords, exposed login portals, or legacy endpoints without MFA, the probability of a password spraying attack remains high.

Healthcare

Password spraying attacks create immediate risks to patient safety and regulatory compliance. Compromised credentials expose electronic health records (EHR) and protected health information (PHI), leading to severe HIPAA violations, mandatory breach notifications, financial penalties, additional audits, and loss of patient trust.

Compromised patient or provider portals result in account takeovers that lock providers out of critical systems during emergencies while disrupting care coordination, appointment scheduling, and prescription management.

Finance

Threat actors can initiate wire fraud, BEC, and customer account takeovers to redirect funds or steal sensitive financial data. Breaches can expose PCI or GLBA-regulated information, which triggers heavy fines, legal consequences, and regulatory investigations. The reputational impact tarnishes customer confidence and market credibility.

Government

Compromise of government accounts can lead to exposure of citizen records, data manipulation, and service outages. Attackers may exploit breaches to access sensitive internal systems, posing risks to national security and public trust. Agencies also face Freedom of Information Act (FOIA) implications and heightened oversight following such incidents.