LSHIY Password Spray Campaign Exploited Azure CLI and MFA Gaps

Huntress reports that password spray attacks increased by 155 times. While password spraying is an established attack technique, the LSHIY campaign used a combination of Azure CLI access, legacy authentication, and IPv6 infrastructure to evade traditional defenses.

One major contributor was a password spraying campaign that targeted Microsoft’s Azure CLI, a command-line tool administrators use to manage Azure and Microsoft Entra resources. The malicious traffic originated from an IPv6 address range controlled by Internet hosting provider LSHIY LLC.

Although the campaign began several months earlier, Huntress observed a sharp increase in activity during mid-June. In just two weeks, attackers generated 81 million login attempts and compromised 78 accounts.

How the LSHIY password spray attack worked

A typical password spray attack follows a predictable sequence:

1. 1. Reconnaissance: Attackers collect valid usernames from LinkedIn, corporate websites, data breach records, phishing campaigns, and other public or stolen sources.

2. 2. Password list creation: Attackers compile a short list of compromised passwords, common passwords such as “Password123,” company name variations, and seasonal terms.

3. 3. Password spraying: Rather than trying many passwords against one account, attackers test one password across multiple accounts. They often use a slow approach to avoid account lockouts and detection.

4. 4. Establishing access: After successfully logging in, attackers may conduct lateral movement, business email compromise, data theft, or additional credential harvesting.

The LSHIY campaign combined the scale of password spraying with previously exposed username-and-password pairs that had not been changed after earlier breaches. As a result, every successful login attempt could provide more value than a typical password guess.

The attackers also abused Resource Owner Password Credentials (ROPC), a legacy OAuth authorization flow that has been deprecated in OAuth 2.1. ROPC was originally designed to help applications transition from direct authentication to OAuth-based authentication.

However, ROPC does not support modern security controls such as multifactor authentication (MFA) and single sign-on (SSO). Instead, applications send a username and password directly to the /token endpoint, which does not provide an interactive MFA prompt. A reused password that remains valid can therefore give an attacker an active session.

This weakness affected organizations that had implemented MFA through Conditional Access Policies (CAP). In many cases, MFA was not configured to protect the specific authentication flow used by the attackers.

Andrew “Spike” Brandt, Huntress Threat Intelligence Incident Lead, said:

“We call this an authentication method, but technically it is a disguise method.”

Huntress did not observe post-compromise activity following successful logins associated with the LSHIY campaign. Rich Mozeleski, a staff product manager at Huntress, suspects the attackers may have been validating credentials for potential resale on dark web marketplaces.

LSHIY later stopped the activity from the original IP range and confirmed that the attacker had been using its Bring Your Own IP (BYOIP) service.

How IPv6 BYOIP infrastructure helped attackers evade detection

Bring Your Own IP is a legitimate service that allows an internet service provider’s customers to route traffic through IP address ranges they control. However, attackers can abuse BYOIP to move between IP ranges and hosting providers, making detection and blocking more difficult.

The LSHIY campaign originated from the IPv6 range 2a0a:d683::/32. Because IPv6 provides a vast pool of available addresses, defenders cannot rely solely on blocking a small number of IP addresses.

After LSHIY shut down the original activity, password spraying attempts moved to IPv6 ranges hosted by FranTech. Later activity appeared on IPv4 infrastructure associated with 3xK Tech. The attackers’ ability to change providers and address ranges created a familiar “whack-a-mole” problem for security teams.

MFA configuration gaps left organizations exposed

The LSHIY campaign did not appear to focus on one particular industry. Instead, it targeted organizations with weaknesses in password security and gaps in their multifactor authentication policies.

Huntress analyzed 23 affected organizations. Eight had no MFA configured. Among the remaining 15 organizations, MFA did not apply to the attackers’ sign-in attempts because policies were restricted to certain applications or user groups, trusted locations, or reporting-only mode.

The findings show that enabling MFA is not enough. Organizations must regularly review the scope and enforcement of their Conditional Access Policies. A policy may appear to require MFA while excluding specific users, applications, locations, or authentication methods.

Conditional Access policies can be difficult to modify without disrupting legitimate users. That complexity is one reason attackers continue to exploit configuration gaps.

How to defend against password spraying and ROPC abuse

The following mitigation strategies can help close the gaps exploited by the LSHIY campaign:

• Improve password hygiene and consider passwordless authentication options.

• Disable ROPC and remove applications that depend on this legacy authentication flow.

• Restrict Azure CLI access to users who need it, particularly administrators and other privileged accounts.

• Do not prioritize incident response solely by the number of password spray attempts. The most heavily targeted tenants may not be the most affected; prioritize accounts with valid credentials.

• Require MFA for all users, cloud applications, and client application types. Block authentication methods that cannot enforce MFA, including traditional ROPC authorization.

• Use Conditional Access settings such as userStrongAuthClientAuthNrequired to enforce strong client authentication and help block ROPC.

“Properly configured and managed Conditional Access is a superpower,” Mozeleski said.

Attackers can change hosting providers and IP ranges faster than defenders can block them. Organizations can reduce the effectiveness of these campaigns by ensuring that passwords alone cannot provide access, limiting Azure CLI permissions, disabling legacy authentication, and applying Conditional Access consistently across users, cloud applications, and client application types.

Tradecraft Tuesday: No products, no pitch—just attacker tradecraft

Tradecraft Tuesday provides cybersecurity professionals with in-depth analysis of current threat actors, attack methods, and mitigation strategies. Each session includes technical walkthroughs of recent incidents, analysis of malware trends, and relevant indicators of compromise (IOCs).

Participants will receive:

• Detailed explanations of emerging threat campaigns and ransomware variants
• Evidence-based defense and remediation techniques
• Direct access to Huntress analysts for incident response insights
• Actionable threat intelligence and detection guidance

Register for Tradecraft Tuesday →

Strengthen your organization’s security posture with real-time threat intelligence and technical education designed for professionals responsible for protecting cloud environments.

Sponsored and written by Huntress Institute.