Full Report
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. [...]
Analysis Summary
# Tool/Technique: Password Spraying (ROPC Abuse & IPv6 BYOIP)
## Overview
Password spraying is a type of brute-force attack where an attacker attempts a single common password against many different accounts to avoid account lockout thresholds. In this specific surge observed in 2026, threat actors combined this technique with the abuse of legacy authentication protocols (ROPC) and high-volume IPv6 infrastructure to bypass Multi-Factor Authentication (MFA) and detection systems.
## Technical Details
- **Type**: Technique / Authentication Abuse
- **Platform**: Microsoft Azure, Microsoft Entra ID (formerly Azure AD), Azure CLI
- **Capabilities**: Credential validation, MFA bypass via legacy flows, IP rotation via BYOIP
- **First Seen**: Large-scale spike observed H1 2026 (LSHIY campaign active June 2026)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1078 - Valid Accounts**
- **TA0006 - Credential Access**
- **T1110.003 - Brute Force: Password Spraying**
- **TA0005 - Defense Evasion**
- **T1562.001 - Impair Defenses: Disable or Modify Tools (Bypassing MFA via ROPC)**
- **T1564.012 - Hide Artifacts: Infrastructure Selection (IPv6/BYOIP rotation)**
## Functionality
### Core Capabilities
- **Automated Login Attempts**: Scaling to millions of attempts (e.g., 81 million in two weeks) targeting the Azure CLI and Microsoft token endpoints.
- **Credential Validation**: Testing "recycled" username/password pairs from previous breaches to identify active accounts for potential resale.
- **Legacy Protocol Exploitation**: Utilizing the **Resource Owner Password Credentials (ROPC)** grant, which sends credentials directly to the `/token` endpoint, effectively bypassing interactive MFA prompts.
### Advanced Features
- **IPv6 BYOIP Utilization**: Using "Bring Your Own IP" services to route traffic through massive IPv6 ranges (e.g., `/32` blocks). This allows for an almost infinite supply of IP addresses, making traditional IP-based rate limiting or blacklisting ineffective.
- **Low and Slow Execution**: Timing sprays to stay beneath the radar of automated account lockout policies.
## Indicators of Compromise
- **File Hashes**: N/A (Cloud-based authentication attack)
- **File Names**: N/A
- **Registry Keys**: N/A
- **Network Indicators**:
- `2a0a:d683::/32` (LSHIY LLC range)
- Activity originating from FranTech-hosted IPv6 ranges
- Activity originating from 3xK Tech
- **Behavioral Indicators**:
- Massive spikes in sign-in attempts to the `Azure CLI` application ID.
- Successful logins using the `ROPC` (Resource Owner Password Credentials) grant type from unusual IP ranges.
- Logins to `/token` endpoints without subsequent interactive MFA challenges.
## Associated Threat Actors
- **LSHIY Campaign Actor**: An unidentified group utilizing LSHIY LLC infrastructure for massive credential validation.
## Detection Methods
- **Behavioral Detection**: Monitor Microsoft Entra ID (Azure AD) sign-in logs for a high volume of "Failure" events (Error code 50126) followed by a "Success" from the same IP or IP range across multiple accounts.
- **Legacy Flow Monitoring**: Specifically audit logs for the use of the `ROPC` grant. In Azure/Entra, this can be filtered in the "Authentication Method" or "Client App" columns of sign-in logs.
- **App-Specific Monitoring**: Look for unusual login volume specifically targeting the `Azure CLI` (App ID: `04b07795-8ddb-461a-bbee-02f9e1bf7b46`).
## Mitigation Strategies
- **Disable Legacy Authentication**: Block ROPC and other legacy protocols (POP, IMAP, SMTP) that do not support modern MFA.
- **Hardening MFA Policies**: Ensure Conditional Access Policies (CAPs) are configured to "All Cloud Apps" and include specific flows like the Azure CLI.
- **Strict Conditional Access**: Implement "Require MFA" for all users regardless of the client application or authentication flow.
- **Password Rotation**: Enforce password resets for accounts identified in historic data breaches.
## Related Tools/Techniques
- **Credential Stuffing**: Using leaked passwords on different sites (similar but uses many passwords per account).
- **Adversary-in-the-Middle (AiTM)**: A more advanced MFA bypass technique, whereas ROPC abuse is a "downgrade" or "gap" exploitation.
- **Azure CLI / PowerShell Brute Forcing**: Targeted spraying of administrative command-line interfaces.