Password Spraying
Password Spraying [T1110.003]
Last updated
Password Spraying [T1110.003]
Last updated
Name: Password Spraying
ID: T1110.003
Tactics:
Technique:
Password Spraying (T1110.003) is a credential access sub-technique within the MITRE ATT&CK framework. It involves attackers attempting to gain unauthorized access to user accounts by systematically using a small number of commonly used passwords against a large number of accounts. Unlike brute force attacks, which target a single account with many passwords, password spraying avoids account lockouts by limiting login attempts per account and distributing attempts across many users. This technique leverages weak, predictable passwords and can often bypass traditional account lockout policies and detection mechanisms.
Password spraying is executed through the following mechanisms and methods:
Target Enumeration:
Attackers first identify a large set of valid usernames or email addresses through:
Open-source intelligence (OSINT)
Enumeration of public directories or employee listings
Social media scraping
Data breaches and credential dumps
Password Selection:
Attackers choose a small set of commonly used or predictable passwords, such as:
"Password123"
"Winter2023"
"Welcome!"
Company-related terms or common seasonal passwords
Password lists can be derived from:
Publicly available leaked password databases
Common password lists (e.g., SecLists, RockYou)
Customized lists based on the target organization's industry, location, or culture
Automated Execution:
Attackers automate the login attempts using scripts or tools designed specifically for password spraying, including:
Burp Suite Intruder
Hydra
CrackMapExec
Metasploit modules
Custom scripting (Python, PowerShell, Bash)
Attackers typically space out login attempts to evade detection and account lockouts, often performing attempts slowly over days or weeks.
Infrastructure and Anonymity:
Attackers frequently employ proxy servers, VPNs, or compromised infrastructure to mask their origin IP addresses.
Cloud services, compromised websites, or botnets may also be leveraged to distribute login attempts and evade detection.
Successful Credential Usage:
Once valid credentials are identified, attackers may:
Gain initial access to networks or cloud services
Escalate privileges or pivot internally
Exfiltrate sensitive data or establish persistent backdoors
Conduct further credential harvesting or lateral movement within the organization
Password spraying is commonly encountered in various attack scenarios and stages:
Initial Access:
Attackers frequently use password spraying to gain initial footholds in organizations by exploiting weak user passwords on:
Webmail portals (e.g., Outlook Web Access)
VPN gateways
Cloud services (e.g., Office 365, Google Workspace)
Remote Desktop Protocol (RDP) services
Credential Access and Privilege Escalation:
Attackers leverage password spraying to identify valid credentials, which can later be used for privilege escalation or lateral movement within internal networks.
Reconnaissance and Persistence:
Password spraying may be periodically repeated as part of ongoing reconnaissance or persistence efforts, especially when attackers have partial access and seek additional valid accounts.
Advanced Persistent Threat (APT) Campaigns:
Nation-state actors frequently employ password spraying to stealthily gain access without triggering lockout policies, thus avoiding detection in long-term espionage campaigns.
Detection methods and indicators of compromise (IoCs) for password spraying include:
Monitoring Authentication Logs:
Identify a high volume of failed login attempts across multiple distinct user accounts originating from a single IP address or range.
Look for login attempts using known common passwords or patterns indicative of password spraying attacks.
Behavioral Analytics and Anomaly Detection:
Deploy User and Entity Behavior Analytics (UEBA) systems to detect anomalies in login patterns, frequency, or geographical origin.
Alert on unusual login attempts at atypical hours or from suspicious locations.
Threshold-based Alerting:
Configure SIEM solutions to trigger alerts when thresholds of failed authentication attempts across multiple accounts are reached within a defined period.
Multi-factor Authentication (MFA) Logs:
MFA logs showing multiple failed attempts or unusual MFA prompts can indicate password spraying attempts.
Honey Accounts and Deception Technologies:
Implement honey accounts with predictable usernames and passwords to detect unauthorized login attempts.
Indicators of Compromise (IoCs):
Repeated authentication failures from suspicious IP addresses or proxies.
Unusual spikes in authentication attempts against cloud or VPN portals.
Presence of known password spraying tools or scripts detected by endpoint protection solutions.
Early detection of password spraying is critical due to the following potential impacts:
Unauthorized Access and Data Breaches:
Successful credential compromise can lead to unauthorized access, data theft, and sensitive information leakage.
Privilege Escalation and Lateral Movement:
Compromised accounts often serve as initial footholds for attackers, enabling them to escalate privileges, move laterally, and achieve persistence within networks.
Business Disruption and Operational Impact:
Attackers with valid credentials can disrupt operations, cause downtime, or sabotage critical business processes and infrastructure.
Compliance and Regulatory Risks:
Failure to detect and mitigate password spraying attacks may result in regulatory fines, legal consequences, and reputational damage due to breaches of sensitive data.
Financial and Reputational Damage:
Credential compromise can lead to financial losses, increased incident response costs, and significant damage to the organization's reputation and customer trust.
Real-world examples of password spraying incidents include:
Microsoft Office 365 Password Spraying Campaigns:
Numerous organizations have been targeted by attackers using password spraying against Office 365 portals to gain access to corporate email accounts.
Attackers commonly use seasonal passwords (e.g., "Summer2023") or predictable patterns (e.g., "CompanyName123") to exploit weak credentials.
Iranian APT Group (APT33) Attacks:
APT33 has conducted extensive password spraying campaigns against U.S.-based organizations, targeting cloud services and VPN gateways.
Attackers leveraged tools like CrackMapExec and custom scripts to automate credential spraying, gaining initial access and subsequently conducting espionage operations.
Citrix Breach (2019):
Attackers successfully employed password spraying to compromise employee credentials, gaining unauthorized access to internal Citrix networks.
The breach led to exfiltration of sensitive internal documentation, highlighting the significant impact of successful password spraying attacks.
"Spray and Pray" Campaigns:
Cybercriminal groups have utilized large-scale password spraying techniques against multiple targets simultaneously, hoping to opportunistically compromise weaker accounts.
These campaigns often leverage automated tools like Hydra, Burp Suite Intruder, or Metasploit modules to conduct widespread credential attacks.
FIN7 Financial Threat Actor:
The FIN7 group has historically employed password spraying techniques to target financial institutions, retailers, and hospitality sectors.
Successful credential compromise enabled attackers to gain initial footholds, escalate privileges, and deploy malware for financial gain and data exfiltration.