Full Report
SecurityScorecard revealed that the large-scale password spraying campaign can bypass MFA and security access policies by utilizing Non-interactive sign-ins
Analysis Summary
# Tool/Technique: Chinese Botnet Targeting Microsoft 365 via Password Spraying
## Overview
A massive botnet, comprised of over 130,000 compromised devices and believed to be affiliated with a Chinese threat group, is actively conducting large-scale password spraying attacks against Microsoft 365 accounts globally. The primary goal is to gain unauthorized access to sensitive data, emails, and collaboration tools by bypassing standard MFA controls through exploiting non-interactive sign-in mechanisms.
## Technical Details
- Type: Malware Campaign / Botnet Infrastructure
- Platform: Microsoft 365 (Cloud environment)
- Capabilities: High-volume credential stuffing/password spraying, exploitation of non-interactive sign-in flows to bypass MFA/Conditional Access Policies, credential theft leveraging infostealer inputs.
- First Seen: Information not explicitly provided in the context, but described as an ongoing campaign (Feb 2025 article date).
## MITRE ATT&CK Mapping
While the article describes an attack chain, the core techniques observed are:
- **TA0001 - Initial Access**
- T1110 - Brute Force: Password Spraying
- **TA0006 - Credential Access**
- T1003 - OS Credential Dumping (Implied, as credentials obtained from infostealers suggest prior compromise/theft)
- **TA0007 - Discovery**
- T1087.004 - Account Discovery: Cloud Accounts (Implied by targeting M365)
## Functionality
### Core Capabilities
- **Credential Spraying:** Systematically attempting to log into numerous M365 accounts using stolen credentials obtained from infostealer malware.
- **Infrastructure Leveraging:** Utilizing over 130,000 compromised devices as part of the botnet for distributed attack attempts.
- **Lateral Movement (Post-Compromise):** Compromised accounts can be used for subsequent activities like internal phishing.
### Advanced Features
- **MFA/CAP Evasion:** Exploiting mechanisms that cause authentication attempts to be logged exclusively in **Non-Interactive Sign-in logs**. These non-interactive sign-ins (often delegated via API or automated services) frequently do not trigger MFA challenges where interactive logins would, allowing the attack to proceed undetected by relying solely on interactive sign-in monitoring.
- **Infrastructure Obfuscation:** Using C2 servers hosted by US-based provider SharkTech, configured with an "Asia/Shanghai" time zone, and leveraging infrastructure linked to CDS Global Cloud and UCLOUD HK (providers with operational links to China).
## Indicators of Compromise
- File Hashes: [Not provided]
- File Names: [Not provided]
- Registry Keys: [Not provided]
- Network Indicators: C2 servers hosted in SharkTech (specific domain/IP defanged: *[SharkTech infrastructure]*), infrastructure tied to CDS Global Cloud and UCLOUD HK.
- Behavioral Indicators: High-volume, automated login attempts targeting M365 that register solely in **Non-Interactive Sign-in logs**.
## Associated Threat Actors
- Chinese-affiliated group (based on infrastructure tracing and C2 server time zone configuration).
## Detection Methods
- **Signature-based detection:** Not specified, but standard login monitoring would likely miss this due to the mechanism used.
- **Behavioral detection:** Monitoring specifically for anomalous login activity categorized within the **Non-Interactive Sign-In logs**.
- **YARA rules:** [Not provided]
## Mitigation Strategies
- **Access Policy Redesign:** Reassess access policies to incorporate controls based on geolocation and device compliance.
- **Conditional Access Implementation:** Implement specific Conditional Access Policies (CAP) designed to **restrict non-interactive login attempts**.
- **Log Review:** Actively review **Non-Interactive Sign-In logs** for unauthorized access attempts that bypass MFA.
- **Legacy Protocol Disablement:** Disable legacy authentication protocols, such as Basic Authentication.
- **Proactive Credential Management:** Monitor underground forums for leaked credentials and swiftly reset accounts that have been compromised.
## Related Tools/Techniques
- Password Spraying (General Technique, T1110)
- Infostealer Malware (Source of initial compromised credentials)
- Use of API/Automated Services for authentication (leading to non-interactive logins)