Full Report
Huntress is seeing an ongoing password spray attack against Microsoft Azure CLI that originates from an IPv6 address range controlled by LSHIY LLC.
Analysis Summary
# Incident Report: Persistent Multi-ASN Azure CLI Password Spray Campaign
## Executive Summary
Since June 2026, Huntress has tracked a massive, automated password spray campaign targeting Microsoft Azure CLI. The attackers have demonstrated high agility, migrating their operations across multiple internet service providers (LSHIY, FranTech, and 3xK Tech) to evade IP-based blocking while attempting millions of logins daily. The primary objective is gaining unauthorized access to Microsoft 365 environments by exploiting the Azure CLI Resource Owner Password Credentials (ROPC) flow.
## Incident Details
- **Discovery Date:** June 30, 2026
- **Incident Date:** Ongoing (Initial report June 30, 2026; updates through July 15, 2026)
- **Affected Organization:** Global (Multiple organizations using Microsoft 365/Azure)
- **Sector:** Cross-sector
- **Geography:** Global origin; attackers utilized ASNs in various regions (e.g., Germany-based 3xK Tech)
## Timeline of Events
### Initial Access
- **Date/Time:** Late June 2026
- **Vector:** Password Spraying via Azure CLI
- **Details:** Attackers targeted the Azure CLI login endpoint, specifically leveraging the Resource Owner Password Credentials (ROPC) grant type, which often bypasses certain legacy conditional access policies.
### Lateral Movement
- **Details:** Upon successful authentication, attackers aim to gain persistence within the Microsoft 365 tenant, though specific post-compromise lateral movement was not detailed in the brief.
### Data Exfiltration/Impact
- **Details:** The primary impact is account takeover and unauthorized access to cloud resources. The campaign reached a volume of roughly 1.5 million attempted logins per day.
### Detection & Response
- **Discovery:** Huntress SOC observed high-volume failed login telemetry originating from specific IPv6 ranges.
- **Response Actions:** Huntress contacted the initial ISP (LSHIY), leading to the suspension of the malicious BYOIP user. However, attackers quickly pivoted to new infrastructure (FranTech and 3xK Tech).
## Attack Methodology
- **Initial Access:** Password Spraying.
- **Persistence:** Not explicitly detailed; typically involves OAuth token generation or MFA registration if not enforced.
- **Defense Evasion:**
- **Infrastructure Hopping:** Moving between ASNs (LSHIY -> FranTech -> 3xK Tech).
- **Protocol Switching:** Using IPv6 initially, then switching to IPv4.
- **Low-and-Slow:** Rotating through ~12,800 IPs and limiting attempts to ~900 per IP to stay under rate-limiting thresholds.
- **Credential Access:** Automated brute-forcing of common passwords against a wide list of usernames.
- **Discovery:** Targeting the Azure CLI specifically to identify valid cloud credentials.
## Impact Assessment
- **Financial:** Potential costs associated with incident response, remediation, and potential downstream business email compromise (BEC).
- **Data Breach:** Risk of unauthorized access to sensitive emails, SharePoint files, and Azure configurations.
- **Operational:** High volume of logs and alerts for security teams; potential account lockouts for legitimate users.
- **Reputational:** Risk to organizations if accounts are used to send further phishing or spam.
## Indicators of Compromise
- **Network Indicators:**
- `2605:6400::/32` (FranTech IPv6)
- `2605:6404::/32` (FranTech IPv6)
- 3xK Tech GmbH (`AS200373`) IPv4 ranges
- Original LSHIY LLC ranges (now suspended)
- **Behavioral Indicators:**
- High volume of failed logins specifically targeting the **Azure CLI** application.
- Login attempts using the Resource Owner Password Credentials (ROPC) flow.
## Response Actions
- **Containment:** Suspension of the initial attacker-controlled BYOIP range by LSHIY.
- **Eradication:** Continuous monitoring and blocking of new ASN ranges as the attacker migrates.
- **Recovery:** Resetting passwords for any accounts that show successful logins from these suspicious ranges.
## Lessons Learned
- **ASN Agility:** Attackers can move between "bulletproof" or lax hosting providers almost instantly, making IP-based blocking a "whack-a-mole" strategy.
- **IPv6 Visibility:** Organizations must ensure their logging and conditional access policies account for IPv6 traffic, which is increasingly used for spraying.
- **Legacy Protocols:** The ROPC flow remains a significant weak point for password spraying.
## Recommendations
1. **Enforce MFA:** Implement Multi-Factor Authentication for *all* users without exception.
2. **Conditional Access:** Restrict Azure CLI access to only authorized administrative users and known IP ranges.
3. **Disable ROPC:** Where possible, disable the Resource Owner Password Credentials grant flow.
4. **Block Malicious ASNs:** Consider blocking or heavily scrutinizing traffic from high-risk ASNs mentioned (AS53667, AS200373).
5. **Geofencing:** Implement location-based login restrictions if the organization does not have global operations.