Full Report
What we learned from tracking a massive automated password spraying campaign on the Azure CLI that leveraged a depreciated OAuth flow.
Analysis Summary
# Tool/Technique: ROPC-Based Password Spraying (Azure CLI Focus)
## Overview
This technique involves a massive, automated password spraying campaign specifically targeting Microsoft’s Azure Command Line Interface (CLI). It exploits the **Resource Owner Password Credentials (ROPC)** grant flow, a deprecated OAuth 2.0 method. Unlike standard spraying, this method is highly effective because it can bypass Multi-Factor Authentication (MFA) and Conditional Access Policies (CAP) if the tenant is not properly hardened, as the flow mints a user-delegated token directly from credentials.
## Technical Details
- **Type:** Technique / Attack Framework
- **Platform:** Microsoft Azure / Microsoft 365
- **Capabilities:** MFA bypass, automated credential validation, token generation, impersonation.
- **First Seen:** Early 2026 (Significant activity spike observed in June 2026).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1110.003 - Brute Force: Password Spraying]
- **[TA0006 - Credential Access]**
- [T1606.001 - Forge Web Credentials: Web Cookies/Tokens]
- **[TA0005 - Defense Evasion]**
- [T1550.001 - Use Alternate Authentication Material: Application Access Token]
- [T1562.001 - Impair Defenses: Disable or Modify Cloud Security Tools] (Bypassing MFA/CAP)
## Functionality
### Core Capabilities
- **Credential Validation:** Automated testing of harvested username/password pairs against the Azure `/token` endpoint.
- **Automated Spraying:** High-volume attempts (81 million+ instances) using a "low and slow" approach to avoid account lockout thresholds.
- **OAuth Impersonation:** Leverages the Azure CLI's trust relationship to request user-delegated tokens.
### Advanced Features
- **MFA/CAP Bypass:** Because ROPC is an "impersonation method" designed for legacy migration, it often side-steps modern security controls like MFA prompts that require interactive user input.
- **BYOIP Utilization:** The campaign leveraged "Bring Your Own IP" (BYOIP) services from providers like LSHIY LLC to mask the attacker's true origin and rotate source addresses within specific ranges.
## Indicators of Compromise
- **Network Indicators:**
- IPv6 ranges associated with `LSHIY LLC` (Defanged: `LSHIY[.]LLC`).
- Heavy traffic directed at Microsoft Azure login endpoints (e.g., `login[.]microsoftonline[.]com/common/oauth2/token`).
- **Behavioral Indicators:**
- Unusual volume of login attempts targeting the **Azure CLI** application ID (`04b07795-8ddb-461a-bbee-02f9e1bf7b46`).
- Successful logins via the `ROPC` grant type from non-standard or foreign IP addresses.
- Spikes in failed login activity followed by a single successful login (potential credential validation).
## Associated Threat Actors
- **LSHIY Campaign Actor:** An unidentified group utilizing LSHIY LLC’s infrastructure (specifically their BYOIP offering).
## Detection Methods
- **Behavioral Detection:** Monitoring Entra ID (Azure AD) Sign-in logs for the "Authentication Method" field. Look for `Resource Owner Password Credentials`.
- **Log Analysis:** Filter logs for the Azure CLI Client ID across multiple accounts originating from the same ISP or ASN.
- **Threshold Alerts:** Set alerts for a high frequency of "Failure Reason: 50126" (Invalid username or password) followed by successful "Grant Type: password".
## Mitigation Strategies
- **Disable ROPC:** Explicitly block or disable the Resource Owner Password Credentials flow within the Azure tenant.
- **Enforce Modern Authentication:** Transition all apps to use modern flows (Authorization Code Flow with PKCE) that require interactive MFA.
- **Hardening Conditional Access:** Configure policies to block "Legacy Authentication" and ensure Azure CLI access is restricted to compliant devices or known IP ranges.
- **Password Policies:** Implement robust password complexity and check against known breached password lists to prevent successful spraying.
## Related Tools/Techniques
- **Credential Stuffing:** The secondary use of validated credentials on other platforms.
- **Device Code Phishing:** Another OAuth-based attack targeting Azure/Google users.
- **BEC (Business Email Compromise):** The typical follow-on objective after successful credential validation.