Ravindra BagaleCourses & study guides मराठी Track your progress

22. Password Attacks

22.8 Password Spraying

By Last updated:

Example first. In January 2024, Microsoft said a Russian state hacking group called Midnight Blizzard broke into its corporate email. The attackers did not use a clever new bug. They used password spraying on an old test account. That account had no MFA. From there, they read emails of some senior leaders.

Why it matters

Most companies lock an account after a few wrong passwords. So guessing many passwords for one person fails fast. Spraying gets around this lock. It is quiet, cheap and it still works, because many people pick weak passwords.

What it is

Password spraying means trying one common password on many accounts. Then the attacker waits, and tries the next password. Each account sees only one or two wrong tries. So no account gets locked.

WordSimple meaning
Account lockoutThe system blocks an account after too many wrong passwords, for example 5.
Brute forceMany passwords tried on one account. Lockout stops it.
Credential stuffingTrying real username and password pairs leaked from another website.
MFAMulti-factor authentication. A second proof, like a code on your phone, after the password.
Sign-in logA record of every login try: who, when, from which IP address, success or fail.
AttackAccountsPasswords per account
Brute force1Thousands
Password sprayingThousands1 or 2
Credential stuffingMany1 leaked pair each

How to defend against it

  1. Turn on MFA for every account, including old test and service accounts.
  2. Block common passwords. For example, Microsoft Entra ID Password Protection can ban words like the company name.
  3. Find and delete old accounts nobody uses.
  4. Watch sign-in logs. One IP failing on many different users is the main sign.
  5. Send that pattern to your SIEM as an alert (Chapter 31).

Worked examples

Worked example 1: The maths of spraying

A company has 1,000 staff. Lockout is after 5 wrong tries.

  1. The attacker tries Welcome@123 once on all 1,000 accounts.
  2. Each account sees only 1 wrong try. Nobody is locked.
  3. If just 3 people use that password, the attacker now has 3 working logins.
  4. Next hour, the attacker tries Pune@2024 on all accounts.

Worked example 2: Spot it in a Linux log

On your own lab server, failed SSH logins go to /var/log/secure. Count how many different users each IP tried.

sudo grep 'Failed password' /var/log/secure \
  | awk '{for(i=1;i<=NF;i++) if($i=="from") print $(i+1), $(i-1)}' \
  | sort -u | awk '{print $1}' | uniq -c | sort -rn | head

Read it like this: an IP with many different user names is spraying. An IP with one user name and many tries is brute force.

Worked example 3: Spot it in the cloud

In Microsoft Entra ID or AWS CloudTrail, look for this pattern:

  1. Same IP address, or a small group of IPs.
  2. Many different user names.
  3. Mostly fails, a few successes.
  4. A success with no MFA is the most urgent. Reset that password first.

Real incident: Microsoft corporate email – Midnight Blizzard (January 2024)

1. What happened

Microsoft found the attack on 12 January 2024. A Russian state group got into a small number of corporate email accounts, including some senior leaders and security staff.

2. How it happened

  1. The attackers used password spraying against an old, non-production test account.
  2. That account had no MFA.
  3. They used the account's access to reach corporate email.

3. How to stop it

  1. MFA on every account, even test accounts.
  2. Remove or lock old accounts.
  3. Alert on one source trying many accounts.

In short

  • Spraying = one common password, many accounts.
  • It avoids lockout because each account sees very few wrong tries.
  • MFA, banned weak passwords and log alerts stop it.
  • In logs: one IP, many users, mostly fails.