Procedure examples

HAFNIUM has gained initial access through password spray attacks.

Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.

APT29 has conducted brute force password spray attacks.

Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.

Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.

Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.

Agrius engaged in password spraying via SMB in victim environments.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.

HEXANE has used password spraying attacks to obtain valid credentials.

APT33 has used password spraying to gain access to target systems.