Iran-Linked “Password Spraying” Targets Municipal Response to Missile Strikes

### Executive Summary Check Point Research observed a coordinated Iran-linked password-spraying campaign against Microsoft 365 environments that targeted primarily municipal organizations in Israel and the UAE, peaking in three waves on March 3, 13, and 23, 2026. Attackers used rotated Tor exit nodes for broad scanning, Israel-geolocated VPN services to bypass geo-fencing once credentials were found, and then accessed/exfiltrated sensitive email data—potentially to support kinetic operations and bombing damage assessment; over 300 organizations in Israel and 25+ in the UAE were impacted. Recommended mitigations include tenant-wide MFA, conditional access/geofencing and Tor blocking, and monitoring for anomalous sign-in activity.