{"id":105063,"date":"2025-03-05T16:45:44","date_gmt":"2025-03-05T08:45:44","guid":{"rendered":"https:\/\/version-2.com\/?p=105063"},"modified":"2025-03-03T16:47:36","modified_gmt":"2025-03-03T08:47:36","slug":"spray-and-pray-botnet-takes-aim-at-microsoft-365","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2025\/03\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/","title":{"rendered":"Spray and Pray: Botnet Takes Aim at Microsoft 365"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\n

Researchers at SecurityScoreCard recently discovered a botnet of over 130,000 devices is conducting password spray attacks against Microsoft 365.  <\/span>Although it hasn\u2019t been confirmed, signs point to the responsible group being from China \u2013 the command-and-control servers are hosted in China and set to a timezone for Asia\/Shanghai, and some of the hosting infrastructure was traced back to two Chinese providers.  <\/span>Researches estimate this has been in progress since December of 2024.  <\/span><\/p>

Microsoft has been rolling out<\/a> required MFA (multi-factor authentication<\/a>) for some time now, but the attackers specifically targeted non-interactive accounts. These accounts do not require manual login but are used by automated processes, background tasks, and service integrations. Since there is no human interaction, there is no MFA.  <\/span><\/p>

The likely goal of this attack is to gain access to sensitive data, e-mails, and collaboration tools like SharePoint.<\/p>

Security researchers have called this<\/a> \u201cthe next evolutionary step forward\u201d of password spray attacks; let\u2019s look at the components to see why this attack is particularly dangerous.<\/p>

Non-interactive sign-ins: Why do we even have these?<\/b><\/h2>

At first glance, the idea of having an account that doesn\u2019t require MFA seems really terrible, and on the surface, it is.  <\/span>But these accounts are used for things that don\u2019t require human interaction \u2013 for instance, a service account that automatically logs into SharePoint to retrieve data or a background process making an API call to sync users between Entra ID and another external system. With no human there to enter the OTP or look at the authenticator app, no MFA is possible, but these tasks are critical to business function.  <\/span><\/p>

What exactly is a botnet?<\/b><\/h2>

A botnet is a network of compromised devices\u2014computers, servers, and IoT devices\u2014that a hacker controls remotely to perform malicious activities.<\/p>

IoT devices<\/a> are particularly attractive targets for hackers looking to build a botnet \u2013 they often have weak security controls, they rarely get security updates when vulnerabilities are found, and many times admins are not even aware they exist \u2013 one study found that 80% of IT leaders<\/a> discovered an unknown IoT device on their network.  <\/span>When they do get compromised and end up as part of a botnet, it\u2019s hard to tell \u2013 the only symptom might be an increase in traffic, which could escape regular monitoring. <\/span><\/p>

The goal of a botnet is large-scale operations; one computer trying to unlock a password with a password spray attack could take years, given a reasonably complex password, but 130,000 devices trying all at once might take just a few hours. <\/span><\/p>

How does a password spray attack work?<\/b><\/h2>

A password spray attack<\/a> is a type of brute-force attack used to gain unauthorized access to user accounts, systems, or networks. It\u2019s different from a traditional brute-force attack, where an attacker attempts to guess a password by systematically trying all possible combinations. In a password spraying attack, the attacker tries a small number of common passwords or a list of commonly used passwords<\/a> against a large number of usernames or accounts.<\/p>

The goal of a password spraying attack is to exploit the fact that many users use weak or easily guessable passwords, such as \u201cpassword,\u201d \u201c123456,\u201d or \u201cadmin.\u201d Instead of trying to guess a specific user\u2019s password, the attacker focuses on gaining access to multiple accounts by trying these common passwords against a broad range of usernames.<\/p>

What makes this attack particularly egregious is the targeting of the non-interactive accounts.  <\/span>Most password spray attacks are thwarted by basic security measures like locking out after a certain number of incorrect passwords, but non-interactive accounts don\u2019t usually have this enabled.  <\/span>Admins would also monitor security logs and set up alerts to be notified if there were suddenly a storm of failed login attempts, but non-interactive logins have their own logs, which are usually ignored.  <\/span>So as long as the background processes are working (the sharepoint backup, the ID sync as mentioned above), there would be a really good chance no one would ever check to see all these failed logins.  <\/span><\/p>

NAC and Conditional Access to the rescue!<\/b><\/h2>

Many of the articles mention that targeting these non-interactive sign-on accounts bypasses conditional access policies, but the truth is that with a good set of policies, you can still protect yourself from attacks like these.<\/p>

Role-based and location-based access control are key \u2013 If you have a machine account that is designed to back up SharePoint or write to a database, those should be the only things it can access, with the least amount of rights to accomplish the job.  <\/span>This protects you in the event of a breach \u2013 the amount of data that can be stolen is extremely limited.  <\/span>Location-based access will protect you against connections from places you know your employees are not located.  <\/span><\/p>

Next, you can implement endpoint risk assessment policies for all accounts \u2013 if the device they are trying to connect from does not have required software, or anti-virus, or is not enrolled in your MDM, it can be an automatic failure.  <\/span>Or it could go to a quarantine network that has internet access but no access to your internal tools \u2013 this allows you to have a BYOD policy for employees but still keep your critical assets safe.  <\/span><\/p>

And finally, the big one \u2013 passwordless authentication.  <\/span>Swapping traditional passwords \u2013 and all the headache for users and IT departments they cause \u2013 for digital certificates is the best move you can make to keep your company secure. Digital certificates cannot be sprayed, brute forced, guessed, phished, or socially engineered. They can\u2019t be forgotten, mistyped, or shared.  <\/span>With 80% of all data breaches<\/a> starting with a compromised password, it\u2019s clear that eliminating passwords significantly reduces your organization\u2019s risk. By adopting passwordless authentication with digital certificates, you remove the weakest link in security\u2014human error\u2014while streamlining user access.<\/p>

As attacks get more sophisticated, it\u2019s important to have the right tools in place to keep you protected.  <\/span><\/p> <\/div> <\/div> <\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

About Portnox<\/strong>
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http:\/\/www.portnox.com<\/a>, and follow us on Twitter and LinkedIn.\u3002<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Researchers at SecurityScoreCard recently discovered a […]<\/p>\n","protected":false},"author":149011790,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1305,424,61],"tags":[352,423,1077],"class_list":["post-105063","post","type-post","status-publish","format-standard","hentry","category-1305","category-portnox","category-press-release","tag-network","tag-portnox","tag-1077"],"acf":[],"yoast_head":"\nSpray and Pray: Botnet Takes Aim at Microsoft 365 - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Spray and Pray: Botnet Takes Aim at Microsoft 365 - Version 2\" \/>\n<meta property=\"og:description\" content=\"Researchers at SecurityScoreCard recently discovered a […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-05T08:45:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn-ilccoen.nitrocdn.com\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\/assets\/images\/optimized\/rev-ce7896f\/www.portnox.com\/wp-content\/uploads\/2025\/02\/Microsoft365Botnet.png\" \/>\n<meta name=\"author\" content=\"tracylamv2\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"tracylamv2\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2025\\\/03\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/\"},\"author\":{\"name\":\"tracylamv2\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/011bc7c3731c930bcfeecd52fefb6365\"},\"headline\":\"Spray and Pray: Botnet Takes Aim at Microsoft 365\",\"datePublished\":\"2025-03-05T08:45:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2025\\\/03\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/\"},\"wordCount\":1013,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn-ilccoen.nitrocdn.com\\\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\\\/assets\\\/images\\\/optimized\\\/rev-ce7896f\\\/www.portnox.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/Microsoft365Botnet.png\",\"keywords\":[\"Network\",\"Portnox\",\"2025\"],\"articleSection\":[\"2025\",\"Portnox\",\"Press Release\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2025\\\/03\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/\",\"url\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/\",\"name\":\"Spray and Pray: Botnet Takes Aim at Microsoft 365 - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn-ilccoen.nitrocdn.com\\\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\\\/assets\\\/images\\\/optimized\\\/rev-ce7896f\\\/www.portnox.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/Microsoft365Botnet.png\",\"datePublished\":\"2025-03-05T08:45:44+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cdn-ilccoen.nitrocdn.com\\\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\\\/assets\\\/images\\\/optimized\\\/rev-ce7896f\\\/www.portnox.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/Microsoft365Botnet.png\",\"contentUrl\":\"https:\\\/\\\/cdn-ilccoen.nitrocdn.com\\\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\\\/assets\\\/images\\\/optimized\\\/rev-ce7896f\\\/www.portnox.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/Microsoft365Botnet.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.portnox.com\\\/blog\\\/cyber-attacks\\\/spray-and-pray-botnet-takes-aim-at-microsoft-365\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Spray and Pray: Botnet Takes Aim at Microsoft 365\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/011bc7c3731c930bcfeecd52fefb6365\",\"name\":\"tracylamv2\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g\",\"caption\":\"tracylamv2\"},\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/tracylamv2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Spray and Pray: Botnet Takes Aim at Microsoft 365 - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/","og_locale":"en_US","og_type":"article","og_title":"Spray and Pray: Botnet Takes Aim at Microsoft 365 - Version 2","og_description":"Researchers at SecurityScoreCard recently discovered a […]","og_url":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/","og_site_name":"Version 2","article_published_time":"2025-03-05T08:45:44+00:00","og_image":[{"url":"https:\/\/cdn-ilccoen.nitrocdn.com\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\/assets\/images\/optimized\/rev-ce7896f\/www.portnox.com\/wp-content\/uploads\/2025\/02\/Microsoft365Botnet.png","type":"","width":"","height":""}],"author":"tracylamv2","twitter_card":"summary_large_image","twitter_misc":{"Written by":"tracylamv2","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#article","isPartOf":{"@id":"https:\/\/version-2.com\/2025\/03\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/"},"author":{"name":"tracylamv2","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/011bc7c3731c930bcfeecd52fefb6365"},"headline":"Spray and Pray: Botnet Takes Aim at Microsoft 365","datePublished":"2025-03-05T08:45:44+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2025\/03\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/"},"wordCount":1013,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"image":{"@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn-ilccoen.nitrocdn.com\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\/assets\/images\/optimized\/rev-ce7896f\/www.portnox.com\/wp-content\/uploads\/2025\/02\/Microsoft365Botnet.png","keywords":["Network","Portnox","2025"],"articleSection":["2025","Portnox","Press Release"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2025\/03\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/","url":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/","name":"Spray and Pray: Botnet Takes Aim at Microsoft 365 - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#primaryimage"},"image":{"@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn-ilccoen.nitrocdn.com\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\/assets\/images\/optimized\/rev-ce7896f\/www.portnox.com\/wp-content\/uploads\/2025\/02\/Microsoft365Botnet.png","datePublished":"2025-03-05T08:45:44+00:00","breadcrumb":{"@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#primaryimage","url":"https:\/\/cdn-ilccoen.nitrocdn.com\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\/assets\/images\/optimized\/rev-ce7896f\/www.portnox.com\/wp-content\/uploads\/2025\/02\/Microsoft365Botnet.png","contentUrl":"https:\/\/cdn-ilccoen.nitrocdn.com\/eoFSpsdoQSBMMDlorhbEswoBOvxnAOPL\/assets\/images\/optimized\/rev-ce7896f\/www.portnox.com\/wp-content\/uploads\/2025\/02\/Microsoft365Botnet.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.portnox.com\/blog\/cyber-attacks\/spray-and-pray-botnet-takes-aim-at-microsoft-365\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"Spray and Pray: Botnet Takes Aim at Microsoft 365"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/011bc7c3731c930bcfeecd52fefb6365","name":"tracylamv2","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9d01d79cbfd8b2e878f5d701a362cc9fca466d33fec977b59706c23c1a2db15c?s=96&d=identicon&r=g","caption":"tracylamv2"},"url":"https:\/\/version-2.com\/en\/author\/tracylamv2\/"}]}},"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-rkz","jetpack_featured_media_url":"","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/105063","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/149011790"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=105063"}],"version-history":[{"count":4,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/105063\/revisions"}],"predecessor-version":[{"id":105067,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/105063\/revisions\/105067"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=105063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=105063"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=105063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}