🎯 Password spraying

The items that name it 17

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  articleas techniques2026-10-28
• AI, Scripts, Operator: Inside the ConnectWise Attack
  writeupas classification.key entities2026-10-26
• China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  articleas techniques2026-10-23It is written here as Password spraying (Storm-0940, accelerated by Artex to machine speed; over 151,000 failed logon events captured by Microsoft).

  Storm-0940, accelerated by Artex to machine speed; over 151,000 failed logon events captured by Microsoft

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
  articleas classification.key entities2026-10-22
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeupas classification.key entities2026-10-21
• ConnectWise Suspends Cloud Services in Response to Cyberattack
  articleas classification.key entities2026-10-19
• ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
  writeupas classification.key entities2026-10-16
• Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
  articleas techniques2026-10-13
• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas techniques2026-10-13
• US Disrupts Chinese State-Sponsored Hacking Tools
  articleas techniques2026-10-09

  EBurst tool used for Microsoft Exchange password spraying for initial access

• Ned Peterson (@NedPeterson99) on X
  threadas classification.key entities2026-10-09
• TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
  articleas techniques2026-10-08

  Technique used by botnets attributed to Chinese threat actors against TP-Link routers, per the complaints.

• [tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs
  articleas techniques2026-09-08

  Used against AWS root user accounts across 150+ organizations.

• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  articleas techniques2026-09-01

  Early initial access method

• Password spraying campaign targets AWS root user accounts across 150+ organizations
  articleas techniques2026-08-31

  Attackers made repeated failed ConsoleLogin attempts against AWS root user accounts at more than 150 organizations

• How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant
  articleas techniques2026-07-22

  Attacker tries one password against every account on a target list, waiting between attempts ('low and slow') to avoid lockout thresholds

• No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
  writeupas techniques2026-06-30

  Massive automated login attempts using previously breached, unrotated username/password combinations against Microsoft 365 accounts