Azure CLI ROPC Password-Spray — LSHIY Campaign (Entra ID / Microsoft 365)

Huntress is tracking a massive, ongoing, automated password-spray attack against Microsoft's Azure command-line interface. Between June 12 and June 26, 2026, the threat actor made more than 81 million login attempts and successfully compromised at least 78 Microsoft accounts across 64 organizations. Compromises ran at a steady 2–4 accounts/day (with 12 on June 19) before a sharp escalation on June 22 — 30 identities across 23 businesses in a single day.

The mechanism is the crux of this hunt: the actor replays old username/password pairs that were breached but never rotated, validating them through the OAuth ROPC (Resource Owner Password Credentials) grant. ROPC is deprecated in OAuth 2.1 and, critically, does not support modern auth flows like MFA or SSO. It takes a username/password at the tenant /token endpoint and mints a user-delegated token with no interactive MFA challenge. Because ROPC does not traverse the authorization endpoint where Conditional Access policies (CAPs) are evaluated, a misconfigured CAP is bypassed entirely.

Of the 23 businesses hit in the June 22 spike, 15 had MFA implemented and enforced via CAP yet were still breached — MFA didn't fire because it was scoped to specific apps (not All Cloud Apps), specific user groups (e.g., admins only), or only non-trusted locations (which the attacker's U.S.-geo-mislabeled IPs evaded), or was left in report-only mode. Eight impacted organizations had no MFA policy at all.

The infrastructure rotates. Activity originated from LSHIY LLC's IPv6-only range 2a0a:d683::/32 (AS32167). After Huntress reported the abuse and LSHIY suspended the BYOIP user (July 2), the actor moved to FranTech (AS53667, ranges 2605:6400::/32 and 2605:6404::/32) — re-spraying 87% of the same accounts — and by July 15 to 3xK Tech GmbH (AS200373) at ~1.5M attempts/day, this time over IPv4 in a low-and-slow pattern rotating ~12,800 IPs at ~900 attempts each.

Decisions: identity-first. The durable signal is in Entra ID sign-in telemetry, so §7 native hunts (SigninLogs/KQL) carry the most weight and §8 CQL targets the same telemetry after it is forwarded to Falcon Next-Gen SIEM. Atomic infrastructure IOCs (IPv6 ranges + ASNs) are provided but the actor rotates ASNs with little effort — so the pack anchors on behavior (Azure CLI ROPC sign-ins, failure→success spray transitions, CA-notApplied successes) rather than on chasing hosting IPs. Every atomic IOC in §4/§10 traces to a saved source snapshot; the Azure CLI application ID is a documented Microsoft public-client constant (labelled, not a campaign IOC).

Working hypothesis: The actor obtained breached-but-unrotated credential pairs from combo lists, then automated ROPC sign-ins against tenant /token endpoints via the Azure CLI public client from IPv6/IPv4 bulletproof-hosting infrastructure. Where a tenant's Conditional Access did not cover the ROPC/Azure-CLI path, a valid pair minted a user-delegated token with no MFA — a silent compromise. Volume and source ASN shift over time (LSHIY → FranTech → 3xK Tech), but the ROPC-flow behavior is constant.

N1 · Azure CLI ROPC sign-ins (core)

All sign-ins to the Microsoft Azure CLI public client using the ROPC grant. Any successful row here is a token minted with no interactive MFA. Anchor on app + protocol; the app ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46 is the documented Azure CLI public client.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46" or AppDisplayName == "Microsoft Azure CLI"
| where AuthenticationProtocol =~ "ropc" or tostring(parse_json(AuthenticationProcessingDetails)) has "ropc"
| project TimeGenerated, UserPrincipalName, ResultType, ConditionalAccessStatus,
    IPAddress, AutonomousSystemNumber, Location, ClientAppUsed
| order by TimeGenerated asc

N2 · Failure → success spray transition per identity

Prioritize by credential validity, not volume: identities that show many ROPC failures (50126) followed by a success (0). These are the confirmed compromises hiding in the noise.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where AppDisplayName == "Microsoft Azure CLI" or AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
| summarize Failures = countif(ResultType == 50126),
            Successes = countif(ResultType == 0),
            FirstFail = minif(TimeGenerated, ResultType == 50126),
            FirstSuccess = minif(TimeGenerated, ResultType == 0),
            SrcIPs = dcount(IPAddress)
    by UserPrincipalName
| where Failures >= 5 and Successes >= 1 and FirstSuccess > FirstFail
| order by Successes desc

N3 · Sign-ins from campaign infrastructure (ASN / IPv6)

Corroborating infra hunt. Perishable — the actor rotates ASNs — so treat hits as enrichment, not a standalone verdict.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where AutonomousSystemNumber in (32167, 955, 53667, 200373)
    or ipv6_is_in_any_range(IPAddress, dynamic(["2a0a:d683::/32","2605:6400::/32","2605:6404::/32"]))
| summarize Attempts = count(), Successes = countif(ResultType == 0),
            Users = dcount(UserPrincipalName)
    by AutonomousSystemNumber, AppDisplayName
| order by Attempts desc

N4 · Successful ROPC where Conditional Access did NOT apply

The MFA/CAP-gap compromise. A successful Azure CLI ROPC sign-in with conditionalAccessStatus == "notApplied" (or failure) means policy never evaluated the flow — exactly the gap this campaign exploits.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where AppDisplayName == "Microsoft Azure CLI" or AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
| where ResultType == 0
| where ConditionalAccessStatus in ("notApplied","failure")
| project TimeGenerated, UserPrincipalName, ConditionalAccessStatus,
    IPAddress, AutonomousSystemNumber, Location
| order by TimeGenerated asc

N5 · Password-spray shape (few sources → many identities)

Classic spray fan-out: a small set of source IPs authenticating against many distinct identities with a high failure ratio. Catches the pattern even before the source ASN is known.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where AppDisplayName == "Microsoft Azure CLI" or AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
| summarize DistinctUsers = dcount(UserPrincipalName), Attempts = count(),
            Failures = countif(ResultType == 50126)
    by IPAddress, bin(TimeGenerated, 1h)
| where DistinctUsers >= 20 and Failures * 1.0 / Attempts > 0.8
| order by DistinctUsers desc

N6 · Post-compromise & CAP-configuration review (runbook)

Not a single query — a runbook item. For every identity surfaced by N2/N4: (a) pull UAL MailItemsAccessed, new inbox rules, and app-consent grants after the success timestamp to scope post-compromise activity; (b) audit the CAP that should have covered Azure CLI — check for app-scoping (not All Cloud Apps), user-group scoping, trusted-location exclusions, and report-only mode. Confirm userStrongAuthClientAuthNRequired is enforced (see §12).

Grouped IOC Quick-Copy

Infrastructure IOCs are perishable (three ASN rotations in weeks) — the durable surface is the ROPC-flow behavior. Every atomic value here appears verbatim in a saved source snapshot. The Azure CLI app ID is a documented Microsoft public-client constant, not a campaign IOC.

type,value,action,severity,expiration,description,tags
ipv6,2a0a:d683::/32,detect,high,2026-10-20,LSHIY AS32167 ROPC spray infra (IPv6-only),campaign:azurecli-ropc-lshiy
ipv6,2605:6400::/32,detect,high,2026-10-20,FranTech AS53667 ROPC spray infra,campaign:azurecli-ropc-lshiy
ipv6,2605:6404::/32,detect,high,2026-10-20,FranTech AS53667 ROPC spray infra,campaign:azurecli-ropc-lshiy
ipv4,REPLACE_WITH_3XK_IPV4,hunt,medium,2026-10-20,3xK Tech AS200373 IPv4 low-and-slow (rotating ~12800 IPs),campaign:azurecli-ropc-lshiy

AS32167   # LSHIY LLC  (initial wave, Jun 12-26; IPv6-only 2a0a:d683::/32)
AS955     # LSHIY LLC  (secondary ASN, China-origin IPv6)
AS53667   # FranTech   (second wave; 2605:6400::/32, 2605:6404::/32)
AS200373  # 3xK Tech GmbH (surge from Jul 15; IPv4 low-and-slow)

# Run in Sentinel / Defender Advanced Hunting (SigninLogs + AADNonInteractiveUserSignInLogs)
N1 Azure CLI ROPC sign-ins (app=Microsoft Azure CLI, protocol=ropc)
N2 Failure->success per identity (many 50126 then a 0) - triage by validity, NOT volume
N3 Sign-ins from AS32167 / AS955 / AS53667 / AS200373 or the 3 IPv6 ranges (enrichment)
N4 result=0 AND conditional_access_status in (notApplied, failure) = MFA-gap compromise
N5 spray fan-out: one src_ip vs >= 20 identities with > 80% failures
N6 (runbook) post-compromise UAL (MailItemsAccessed, inbox rules, app consent) + CAP config audit
# Verify both sign-in log streams enabled + retained; confirm userStrongAuthClientAuthNRequired enforced

Sign-in to "Microsoft Azure CLI" public client using the ROPC (Resource Owner Password Credentials) grant
Successful ROPC token (result 0) with conditional_access_status = notApplied or failure
Per-identity many invalid-credential failures (50126) followed by a success (0)
One source IP authenticating against many distinct identities (>80% failure ratio)
One identity sprayed from many rotating source IPs at low per-IP volume (3xK phase)
Source IP geo-mislabeled to U.S. while ASN resolves to China / bulletproof hosting

app_display_name = "Microsoft Azure CLI"
app_id          = 04b07795-8ddb-461a-bbee-02f9e1bf7b46   # documented Microsoft first-party public client
authentication_protocol = ropc                            # deprecated OAuth 2.0 grant, no MFA/SSO support
token_endpoint  = https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token
# These identify the flow being abused; they are legitimate Microsoft values, not attacker infrastructure.

Require MFA (or block) for All Users + All Cloud Apps + All Client App types, unconditionally
Block legacy authentication clients via Conditional Access (ROPC rides the legacy path)
Enforce userStrongAuthClientAuthNRequired to block ROPC flows at the client-auth level
Restrict the "Microsoft Azure CLI" application to admins / required-assignment only
Force password reset for any identity with a successful ROPC sign-in; assume breached combo
Do NOT triage by spray volume; prioritize by credential validity (failure->success)
Review CAPs for app-scoping, group-scoping, trusted-location exclusions, report-only mode

The fix is closing the ROPC/MFA gap, not chasing the source ASN. Blocking legacy auth and requiring MFA unconditionally makes a valid stolen credential insufficient — which is the whole game here.

1 · Block legacy authentication + require MFA for all cloud apps (Microsoft Graph PowerShell)

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Application.Read.All"
# Baseline policy: require MFA for ALL users / ALL apps / ALL client types (report-only first, then enforce)
$params = @{
  DisplayName = "CA - Require MFA All Apps All Clients (ROPC gap closure)"
  State = "enabledForReportingButNotEnforced"   # flip to "enabled" after validation
  Conditions = @{
    Users = @{ IncludeUsers = @("All") }
    Applications = @{ IncludeApplications = @("All") }
    ClientAppTypes = @("all")                     # includes legacy/other-clients (ROPC path)
  }
  GrantControls = @{ Operator = "OR"; BuiltInControls = @("mfa") }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params
# Separate policy to BLOCK legacy auth explicitly:
#   ClientAppTypes = @("exchangeActiveSync","other"); GrantControls BuiltInControls = @("block")

2 · Restrict the Microsoft Azure CLI application to assigned admins

# Entra admin center -> Enterprise applications -> Microsoft Azure CLI
#   Properties: "Assignment required?" = Yes; "Enabled for users to sign-in?" = Yes (assigned only)
#   Users and groups: assign only the admin group that legitimately uses the CLI.
# Graph equivalent (set appRoleAssignmentRequired on the service principal):
Connect-MgGraph -Scopes "Application.ReadWrite.All"
$sp = Get-MgServicePrincipal -Filter "appId eq '04b07795-8ddb-461a-bbee-02f9e1bf7b46'"
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AppRoleAssignmentRequired:$true

3 · Revoke sessions + force reset for identities with a successful ROPC sign-in

Connect-MgGraph -Scopes "User.ReadWrite.All"
# For each UPN surfaced by N2/N4 (successful ROPC):
Revoke-MgUserSignInSession -UserId user@contoso.example      # invalidates refresh tokens
Update-MgUser -UserId user@contoso.example -PasswordProfile @{
  ForceChangePasswordNextSignIn = $true                       # force rotation of the breached pair
}
# Then confirm the user is in scope of the MFA CA policy from playbook #1.

4 · Confirm ROPC is blocked at the client-auth level

# Enforce strong client authentication (blocks ROPC). Validate via a controlled ROPC attempt:
#   az login -u <test-upn> -p <pw>  --allow-no-subscriptions   # (lab/test tenant only)
# Expected AFTER hardening: sign-in FAILS / is interrupted; N1/Q1 shows no successful ROPC token.
# Re-run N4/Q4: zero successful ROPC + CA-notApplied rows for the test identity.

Validation gates: confirm both sign-in log streams (interactive + non-interactive) are ON and retained across the campaign window (Jun 12+); validate the NG-SIEM Entra parser field names on a real row before trusting Q1–Q6; build the sanctioned-ROPC allow-list; lab-test a controlled ROPC sign-in for N1/Q1 and N4/Q4. Promote Q4/N4 and Q2/N2 to alerts; keep Q3/Q5/Q6 as tuned hunts. The infra IOC hunt (Q3/N3) is perishable — a clean result does not clear the tenant.

HuntPack v0.1 · Azure CLI ROPC Password-Spray (LSHIY campaign) · Generated 2026-07-22 · Defensive use only — no offensive code. This is an identity / IdP hunt: the compromise lives in Entra ID sign-in telemetry, not on the endpoint. Hunt the ROPC-flow behavior (N1/N4) first, triage by credential validity (N2) not spray volume, and close the gap with unconditional MFA + legacy-auth blocking + userStrongAuthClientAuthNRequired. NG-SIEM Entra parser field names are tenant-specific — validate before promoting any query.