FranTech

Reported Context (2)

After LSHIY shut down the original activity, the spray attempts first shifted to FranTech-hosted IPv6 ranges. Huntress Reports 155-Fold Surge in Password Spraying, Citing LSHIY Campaign
Since LSHIY's takedown, the threat actor appears to have moved to an IP block hosted by ISP FranTech (AS53667), spraying from two IPv6 ranges (2605:6400::/32, 2605:6404::/32), as well as IPv4 ranges via Tor exit nodes. Password-Spraying Campaign Exploited Deprecated OAuth Flow to Bypass MFA

MITRE ATT&CK (2)

Vendors (3)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.