No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

What it is

An ongoing Microsoft 365 / Entra password spray campaign that Huntress has tracked since early June 2026, notable less for its scale than for its BYOIP ASN-hopping: the same actor keeps the same target list while jumping providers each time one shuts them down. Confirmed hops: LSHIY LLC (AS32167, suspended 7/2) → FranTech (AS53667, IPv6) → 3xK Tech GmbH (AS200373, IPv4). The constant across all three is Azure CLI ROPC (Resource Owner Password Credentials) logins.

How it works

BYOIP (Bring Your Own IP) lets the owner of an IP range obtain peering from an ISP. Because the attacker owns the ranges, moving to a new ISP after a takedown costs "little-to-no effort" — the same address space simply re-peers elsewhere. That is why 87% of accounts sprayed from FranTech had already been sprayed from LSHIY: same actor, same list, new upstream.

The 3xK Tech wave is deliberately low-and-slow to defeat detection: ~12,800 IPv4 addresses, each capped at ~900 attempts, yielding ~1.5M logins/day — matching original LSHIY volume while keeping per-IP counts low enough to slip rate-limit and impossible-travel heuristics.

Preconditions / Affected

• Tenants allowing ROPC / Azure CLI logins for non-admin users.
• Conditional Access is not sufficient by itself — many compromised orgs had CA policies, but they were configured in a way that didn't cover the ROPC/Azure CLI path the attackers used.
• Accounts without enforced MFA.

What to do

The page's core recommendation, restated across every update:

• Require MFA for all users (not just admins).
• Lock down Azure CLI access for non-admin users.
• Audit Conditional Access policies specifically for ROPC / legacy auth coverage — presence of a CA policy is not proof the attack technique is blocked.
• Don't rely on ASN/IP blocking alone; the authors call chasing ASNs "a game of whack-a-mole."

Caveats

• Scale numbers are Huntress-customer-scoped, not internet-wide: 81M attempts, 78 accounts across 64 orgs (June 12–26). Broader context — credential spray up 155× in six months; ~1,964 mean / 804 median failed attempts per protected tenant per month — is also within-Huntress data.
• The IPv4 low-and-slow pattern is current-as-of-writing; the authors explicitly expect it may shift back to IPv6.

flowchart TD
  A[Actor owns IP ranges - BYOIP] --> B[Peer via ISP]
  B --> C[Azure CLI ROPC spray]
  C -->|ISP suspends after abuse report| D[Re-peer at next ASN]
  D --> B
  C -->|reaches tenant| E{MFA + Azure CLI locked down?}
  E -->|No| F[Account compromised]
  E -->|Yes| G[Spray fails - chain cut]