Iran targets M365 accounts with password-spraying attacks

**Executive summary:** Suspected Iran-linked operators conducted three waves of password-spraying against Microsoft 365 accounts targeting more than 300 organizations (mainly Israeli municipalities and some UAE targets) using Tor exit nodes, commercial VPNs, and red-team tools; researchers believe the campaign likely supported kinetic operations and bomb-damage assessment by enabling access to sensitive emails and data.