Iranian APT Group Conducts Password Spray Attacks on Microsoft 365 Accounts

**Executive Summary:** In March 2026 the suspected Iranian APT group Gray Sandstorm conducted a multi-wave password spraying campaign against Microsoft 365 accounts at over 300 Israeli organizations and 25+ in the UAE, using weak credentials, rotating Tor exit nodes, and VPNs to evade detection and access sensitive information; the operation is ongoing and being monitored by researchers.