Suspected Iran-Linked Campaign Targets 300+ Israeli Microsoft 365 Organizations
Summary
Check Point says a suspected Iran-linked actor conducted three password-spraying waves against Microsoft 365 tenants, affecting 300+ organizations in Israel and 25+ in the UAE. The article also reports a Pay2Key attack on a U.S. healthcare organization.
Key points
- Check Point reported three password-spraying waves on March 3, 13, and 23, 2026, targeting Microsoft 365 environments.
- The suspected Iran-linked campaign reportedly affected more than 300 organizations in Israel and over 25 in the UAE, with limited activity in several other countries.
- The campaign reportedly used Tor exit nodes and commercial VPN infrastructure; Check Point cited similarities to activity associated with Gray Sandstorm.
- Organizations were advised to enforce MFA, monitor sign-in and audit logs, and restrict authentication with geographic conditional-access controls.
- A U.S. healthcare organization was reportedly targeted by Pay2Key in late February 2026. The access route was undetermined; the attackers reportedly used a remote-access tool, harvested credentials, deployed ransomware, and cleared logs.
- Beazley Security and Halcyon said no data was exfiltrated in the Pay2Key attack.
- A Linux Pay2Key variant was also reported; Morphisec described it as requiring root privileges and using ChaCha20 encryption.
Article Details
- Event Type
- Reported password-spraying campaign against Microsoft 365 organizations and a separate Pay2Key ransomware attack against a U.S. healthcare organization.
- Impact
- The password-spraying campaign reportedly affected more than 300 organizations in Israel and over 25 in the U.A.E., with limited targeting also observed in Europe, the United States, the United Kingdom, and Saudi Arabia. The campaign involved attempts to access accounts and exfiltrate mailbox content. In the separate Pay2Key attack, no data was reportedly exfiltrated; the attackers deployed ransomware and cleared logs.
MITRE ATT&CK
T1053.003 · CronThe Linux Pay2Key variant reportedly installed a reboot-time cron entry.T1110.003 · Password SprayingThe reported campaign used password spraying against Microsoft 365 tenants.T1114 · Email CollectionThe password-spraying campaign reportedly exfiltrated sensitive mailbox content.T1219 · Remote Access ToolsThe Pay2Key attack reportedly used a legitimate remote access tool such as TeamViewer to establish a foothold.T1486 · Data Encrypted for ImpactThe Linux Pay2Key variant was described as encrypting data.T1562.001 · Disable or Modify ToolsThe Pay2Key attackers reportedly disarmed Microsoft Defender Antivirus and weakened defenses before encryption.
People
Threat Actors
DEV-0343The article identifies DEV-0343 as the former name of Gray Sandstorm, a group whose activity Check Point said the campaign resembled.Fox KittenThe article says the Pay2Key ransomware-as-a-service operation has ties to Fox Kitten; it does not say Fox Kitten carried out the reported healthcare attack.Gray SandstormCheck Point assessed that the password-spraying campaign had similarities to Gray Sandstorm activity, including use of red-team tools via Tor exit nodes. The article says Gray Sandstorm was formerly known as DEV-0343.Pay2KeyIdentified as an Iranian ransomware group that targeted a U.S. healthcare organization in late February 2026. The article reports that the attack used upgraded Windows and Linux variants and that no data was exfiltrated.Peach SandstormThe article cites Peach Sandstorm as an Iranian hacking group known to have adopted password spraying in the past; it does not attribute this campaign to the group.SicariiIdentified as a ransomware group whose administrator urged pro-Iranian operators to use Baqiyat 313 Locker because of affiliate requests.UkeIdentified as the administrator of Sicarii ransomware who urged pro-Iranian operators to use Baqiyat 313 Locker.
Malware
Vendors
Beazley SecurityAccording to Beazley Security and Halcyon, no data was exfiltrated during the attack, a shift from the group’s double extortion playbook.Check PointThe activity, assessed to be ongoing, was carried out in three distinct attack waves that took place on March 3, March 13, and March 23, 2026, per Check Point.HalcyonAccording to Beazley Security and Halcyon, no data was exfiltrated during the attack, a shift from the group’s double extortion playbook.Morphisecbroad file system scope, classify mounts, and encrypt data using ChaCha20 in full or partial modes,” Morphisec researcher Ilia Kulmin said in a report published last month.
Products
Microsoft 365 Apps for Enterpriseactor is suspected of running a threeâwave passwordâspraying campaign in March 2026 against Microsoft 365 cloud environments in Israel and the U.A.E., impacting more than 300 organizations in Israel and overMicrosoft Defender Antiviruslike TeamViewer to establish a foothold, then harvest credentials for lateral movement, disarm Microsoft Defender Antivirus by falsely signaling that a third-party antivirus product is active, inhibit recovery, deployTeamVieweran undetermined access route to breach the organization, using a legitimate remote access tool like TeamViewer to establish a foothold, then harvest credentials for lateral movement, disarm Microsoft Defender
Countries
IranAn Iran-nexus threat actor is suspected to be behind a password-spraying campaign targeting Microsoft 365 environments in Israel and the U.A.E.Israela threeâwave passwordâspraying campaign in March 2026 against Microsoft 365 cloud environments in Israel and the U.A.E., impacting more than 300 organizations in Israel and over 25 in the U.A.E., with limitedSaudi ArabiaIsrael and over 25 in the U.A.E., with limited targeting observed in Europe, the U.S., the U.K., and Saudi Arabia.U.A.E.passwordâspraying campaign in March 2026 against Microsoft 365 cloud environments in Israel and the U.A.E., impacting more than 300 organizations in Israel and over 25 in the U.A.E., with limited targetingUnited Kingdom“Activity associated with the same actor was also observed against a limited number of targets in Europe, the United States, the United Kingdom, and Saudi Arabia.”United Statesthan 300 organizations in Israel and over 25 in the U.A.E., with limited targeting observed in Europe, the U.S., the U.K., and Saudi Arabia.
Industries
EnergyThe campaign is assessed to have targeted the cloud environments of government entities, municipalities, technology, transportation, energy sector organizations, and private-sector companies in the region.GovernmentThe campaign is assessed to have targeted the cloud environments of government entities, municipalities, technology, transportation, energy sector organizations, and private-sector companies in the region.Healthcarehealthcare organization using upgraded Windows and Linux variants and tactics including remoteâaccess footholds, credential harvesting, log clearing, and improved evasion; organizations are urged to enforce MFA,MunicipalitiesThe campaign is assessed to have targeted the cloud environments of government entities, municipalities, technology, transportation, energy sector organizations, and private-sector companies in the region.TechnologyThe campaign is assessed to have targeted the cloud environments of government entities, municipalities, technology, transportation, energy sector organizations, and private-sector companies in the region.TransportationThe campaign is assessed to have targeted the cloud environments of government entities, municipalities, technology, transportation, energy sector organizations, and private-sector companies in the region.