Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to launch highly evasive password spray attacks, successfully stealing credentials from multiple Microsoft customers. 

The stolen credentials are then leveraged by threat actors like Storm-0940 to gain unauthorized access to systems.

Storm-0940 has been an active threat actor since 2021 and primarily targets organizations in North America and Europe, including government, non-profit, and private sector entities. 

The group leverages brute-force attacks, exploits, and compromised network services to gain initial access, so Microsoft has notified affected organizations and provided mitigation and detection recommendations. 

It includes identifying and blocking malicious IP addresses, strengthening password policies, and implementing network segmentation.

Organizations can also use security analytics tools to detect suspicious activity associated with Storm-0940.

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

A Chinese threat actor has compromised a large number of TP-Link SOHO routers, forming ...