No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

1. Executive summary

Huntress is tracking a massive, automated password spray attack targeting Microsoft's Azure command-line interface (CLI), originating from IPv6 address range 2a0a:d683::/32 controlled by internet infrastructure provider LSHIY LLC (AS32167). Between June 12 and June 26, 2026, the actor made over 81 million login attempts against Huntress customer accounts, successfully compromising at least 78 Microsoft accounts across 64 organizations. The actor exploited previously breached credentials that had never been rotated, and notably bypassed Conditional Access policies that were misconfigured or did not cover the techniques in use. Attribution to actor "LSHIY" is unconfirmed — LSHIY LLC is the hosting/BYOIP provider whose infrastructure was abused; the actor has no MITRE ATT&CK profile. LSHIY suspended the responsible user on July 2, 2026, and attacks from the range have ceased. EMEA financial services tenants using Azure CLI with legacy or non-rotated credentials and incomplete Conditional Access coverage are at risk of initial access leading to account takeover.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	Ongoing password spray attack compromising Microsoft accounts constitutes an ICT-related incident requiring detection, analysis, and response.	Financial entities must ensure their incident management process can detect and respond to credential spray attacks against cloud identities.
DORA Art. 18: classification of ICT-related incidents and cyber threats	78 accounts compromised across 64 organizations via automated credential spray — requires classification per the entity's taxonomy.	Classify the incident severity; account takeover of Microsoft 365 identities may meet major-incident thresholds depending on data access.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If compromised accounts accessed sensitive financial data or disrupted operations, major-incident reporting may be triggered.	Assess whether the scope of account compromise meets the entity's major-incident criteria and report within applicable timelines.
DORA Art. 24: digital operational resilience testing — general requirements	Conditional Access policies were present but did not cover the techniques used — indicating a gap in resilience testing.	Test Conditional Access policies against credential spray and token abuse scenarios; validate legacy credential coverage.
NIS2 Art. 21(2)(d): supply chain security measures	Attack abused third-party hosting infrastructure (LSHIY LLC BYOIP) as the attack origin.	Review threat intelligence feeds and network controls for traffic from high-risk hosting ASNs.
NIS2 Art. 23: incident reporting obligations	Successful account compromises may trigger NIS2 incident reporting for in-scope entities.	Assess notification obligations if the compromise affected essential/important services.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties	OES/RDSP operators with compromised Microsoft accounts may need to assess reportability.	Evaluate whether account compromise constitutes a notifiable incident under UK NIS.

3. Technical analysis & attack chain

Attack chain (confirmed steps)

Infrastructure preparation: The threat actor operated from IPv6 address range 2a0a:d683::/32 assigned to LSHIY LLC (AS32167). LSHIY confirmed the responsible customer was a BYOIP (Bring Your Own IP) user — meaning the actor owned the IP range and obtained peering services from LSHIY. Some IPs in the campaign geolocated to China via third-party telemetry; others geolocated to Nebraska (U.S.), reflecting inconsistencies in geolocation databases rather than definitive origin.
Credential acquisition: The actor used previously breached username/password combinations from credential combo lists that had never been rotated by the target organizations. Targeting was based entirely on password prevalence in compromised lists — not specific to business type or industry.
Password spray execution: The actor targeted Microsoft's Azure CLI with automated password spray attacks. Between June 12 and June 26, 2026, over 81 million login attempts were observed by Huntress across its customer base. The attack volume surged on June 22, with 30 accounts compromised across 23 businesses in a single day.
Conditional Access bypass: Many compromised organizations had Conditional Access policies in place, but the configurations did not cover the techniques used by the threat actor. The specific gap was not fully detailed in the source, but the implication is that the policies did not block legacy authentication protocols or did not cover Azure CLI as a client application.
Account compromise: At least 78 Microsoft accounts were compromised across 64 organizations over the 14-day window. Between June 12–21, compromises averaged 2–4 accounts daily (with a spike of 12 on June 19). On June 22, 30 accounts were compromised.
Attack cessation: After Huntress contacted LSHIY and reported the malicious behavior, LSHIY suspended the BYOIP user's service. Huntress confirmed attacks from the IP range had terminated as of July 2, 2026.

Context on broader trend: Huntress observed credential spray attack volume increase by over 155 times across its customer base in the past six months. The current mean is approximately 1,964 failed attacks per month per Huntress-protected tenant; the median is 804 per month. These numbers skew heavily toward certain targeted businesses.

Confidence caveat: All technical detail above is single-sourced from Huntress, corroborated by SecurityWeek and The Hacker News for the headline figures (81M+ attempts, 78 accounts, LSHIY/AS32167 origin). The specific Conditional Access bypass mechanism is not fully detailed in the available source material — verify before enforcement. Attribution to "LSHIY" as an actor name is unconfirmed; LSHIY LLC is the infrastructure provider, not a confirmed threat actor group. No MITRE ATT&CK profile exists for "LSHIY."

4. Mitigation & containment

P1 — Within 24 hours

Block the attack infrastructure: Add 2a0a:d683::/32 (AS32167 / LSHIY LLC) to firewall, proxy, and Azure AD Conditional Access named-location block lists. Note: LSHIY has suspended the user and attacks have ceased, but blocking the range remains prudent defense-in-depth.
Audit for compromised accounts: Query Azure AD sign-in logs for successful authentications from 2a0a:d683::/32 or AS32167 during June 12–July 2, 2026. Focus on Azure CLI client app (App ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46) sign-ins. Revoke tokens for any matches and force password reset.
Identify non-rotated legacy credentials: Cross-reference Entra ID user accounts against known breached credential lists (e.g., HaveIBeenPwned API, Microsoft's compromised credentials service). Force password reset for any matches.

P2 — Within 72 hours

Review and remediate Conditional Access policies: Ensure policies cover Azure CLI as a client application. Block legacy authentication protocols (IMAP, POP, SMTP, MAPI, EWS, ActiveSync) where not required. Require MFA for all sign-ins including programmatic/CLI access. Explicitly block sign-ins from untrusted/unrecognized IP ranges.
Enable Azure AD Identity Protection: Ensure risk-based policies (impossible travel, unfamiliar sign-in properties, leaked credentials) are enabled and configured to block or require MFA on medium+ risk sessions.
Disable stale accounts: Identify and disable accounts with no sign-in activity for 90+ days that still hold valid credentials.

P3 — Within 7 days

Enforce password rotation policy: Implement mandatory password rotation for any accounts found in breached credential databases. Consider banning common passwords via Azure AD custom banned password lists.
Audit Azure CLI usage: Review which service accounts and users legitimately require Azure CLI access. Restrict access using role-based access control (RBAC) and conditional access targeting the Azure CLI client app ID.
Threat hunt for post-compromise activity: For any confirmed compromised accounts, review Microsoft 365 audit logs for mailbox rule creation, file downloads, OAuth app grants, and federation trust modifications.
Network-level controls: Evaluate whether traffic from hosting provider ASNs (particularly BYOIP ranges) should be treated as high-risk in SIEM correlation rules and Conditional Access named locations.

5. Indicators of compromise

Type	Value	Confidence	Source
IPv6 CIDR	2a0a:d683::/32	High	Huntress, The Hacker News
ASN	AS32167	High	Huntress
Organization	LSHIY LLC	High	Huntress
Client app targeted	Microsoft Azure CLI	High	Huntress
Timeframe	2026-06-12 through 2026-06-26 (active); ceased 2026-07-02	High	Huntress

ipv6_cidr  2a0a:d683::/32
asn  AS32167
org  LSHIY LLC

6. Detection

rule LSHIY_Password_Spray_Azure_CLI {
  meta:
    author = "Adverse Trace"
    date = "2026-07-09"
    reference = "https://www.huntress.com/blog/lshiy-password-spray-attack"
    description = "Detects artefacts associated with LSHIY-originated Azure CLI password spray campaign"
  strings:
    $ip_range = "2a0a:d683::/32" ascii
    $asn = "AS32167" ascii
    $org = "LSHIY LLC" ascii
    $cli_app = "04b07795-8ddb-461a-bbee-02f9e1bf7b46" ascii
  condition:
    2 of them
}

title: Azure CLI Authentication from LSHIY AS32167 IPv6 Range
id: 7a3c1f2e-9b4d-4a8c-b6e7-1f5a3d9c8b2e
status: experimental
description: >
  Detects successful or failed Azure CLI sign-in attempts originating from
  the 2a0a:d683::/32 range associated with LSHIY LLC (AS32167), linked to
  a massive password spray campaign reported by Huntress (June 2026).
references:

  - https://www.huntress.com/blog/lshiy-password-spray-attack
  - https://www.securityweek.com/massive-password-spray-campaign-targeting-azure-cli/
  - https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html
author: Adverse Trace
date: 2026/07/09
tags:

  - attack.credential_access
  - attack.t1110.003
  - attack.initial_access
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ip:
    Location|contains:

      - "2a0a:d683"
  selection_app:
    AppId: "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
    ClientAppUsed|contains:

      - "CLI"
      - "Azure CLI"
  filter_success:
    ResultType: 0
  condition: selection_ip and selection_app
falsepositives:

  - Legitimate Azure CLI usage from infrastructure hosted on LSHIY BYOIP ranges (unlikely after July 2 suspension)
level: high

title: Spike in Failed Azure CLI Authentications - Potential Password Spray
id: 3b8d2c1a-7e5f-4b9a-8d6c-2f4e1a9b7c3d
status: experimental
description: >
  Detects a high volume of failed Azure CLI sign-in attempts within a short
  window, consistent with the password spray pattern observed in the LSHIY
  campaign (81M+ attempts over 14 days).
references:

  - https://www.huntress.com/blog/lshiy-password-spray-attack
author: Adverse Trace
date: 2026/07/09
tags:

  - attack.credential_access
  - attack.t1110.003
logsource:
  product: azure
  service: signinlogs
detection:
  selection_cli:
    AppId: "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
  selection_failed:
    ResultType:

      - 50126
      - 50053
      - 50055
      - 50056
  timeframe: 1h
  condition: selection_cli and selection_failed | count() > 100
falsepositives:

  - Misconfigured automation scripts with expired credentials
  - Legitimate CI/CD pipeline authentication failures
level: medium

7. Sources

Huntress — "No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack" — https://www.huntress.com/blog/lshiy-password-spray-attack — 2026-06-30 (updated 2026-07-02)
SecurityWeek — "Massive Password Spray Campaign Targeting Azure CLI" — https://www.securityweek.com/massive-password-spray-campaign-targeting-azure-cli/ — 2026-07
The Hacker News — "Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts" — https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html — 2026-07

8. Adverse Trace position

This is a high-severity identity-focused campaign. The attack is technically unsophisticated — relying on previously breached, non-rotated credentials — but its scale (81M+ attempts) and success rate (78 confirmed compromises across 64 organizations) demonstrate that basic credential hygiene and Conditional Access misconfiguration remain systemic gaps. The attack has ceased following LSHIY's suspension of the BYOIP user, but the underlying tradecraft (Azure CLI-targeted password spray with legacy credential abuse) is replicable by any actor with access to breach databases. EMEA financial services clients should treat this as a prompt to audit Azure CLI sign-in logs for the identified IP range, validate Conditional Access coverage for programmatic clients, and enforce rotation of any credentials appearing in known breach corpora. Attribution to "LSHIY" as a named actor is unconfirmed — the entity is the infrastructure provider, not a confirmed threat group. All technical detail is single-sourced from Huntress with headline figures corroborated by SecurityWeek and The Hacker News; verify before enforcement. Adverse Trace will continue monitoring for resurgence from alternative infrastructure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.