According to the joint CISA advisory AA24-290A published 16 October 2024, Iranian cyber actors have since October 2023 used password spraying and MFA push bombing against Microsoft 365, Azure, and Citrix workforce accounts. Where push MFA was enabled, they spammed approvals until a user accepted. After the foothold they registered their own MFA devices so access outlived the first login.
Public reporting does not name individual victim organizations or record counts. The advisory covers critical-infrastructure sectors including healthcare, government, IT, engineering, and energy. Actors often aimed to gather credentials and network detail for sale on cybercriminal forums. A fix for the phishable login and enrollment path exists; this post stays on what broke.
If you want the prevention angle, read the related article on mfa2point0.com.
FAQ
How did Iranian actors get into Microsoft 365 accounts in AA24-290A?
Iranian actors in the AA24-290A campaign got initial access mainly by password spraying valid user and group email accounts on Microsoft 365, Azure, and Citrix. According to CISA, brute force including password spraying has been in use since October 2023, sometimes with initial credential sources described as unknown. Public tooling such as DomainPasswordSpray.ps1 was imported and was likely used for spraying. When the password worked and no stronger gate blocked interactive sign-in, the account was open.
What is MFA push bombing in this campaign, and how did it beat MFA?
MFA push bombing in AA24-290A is the technique of bombarding a user with mobile push notifications until the user approves by accident or to stop the noise. CISA calls this MFA fatigue or push bombing. The sprayed password alone was not enough where push MFA was on. One rubber-stamped approval completed a full workforce sign-in. That is a credential-phase failure of approve/deny push, not a mystery bypass of cryptography the user never had.
How did the attackers keep access after the first successful login?
After foothold, the actors frequently modified MFA registrations and enrolled their own devices so later logins used attacker-controlled factors. According to CISA, in two confirmed compromises they used open MFA registration windows on compromised users. In another, they used self-service password reset tied to public-facing ADFS to reset expired-password accounts, then registered MFA through Okta for accounts that lacked MFA. Persistence sat on enrollment and recovery paths that still accepted phishable or attacker-driven factor adds.
Was this session-token theft or a pure credential attack?
AA24-290A is primarily a credential-phase story: sprayed passwords, push approvals, and attacker MFA device registration. Public reporting does not frame the initial access as adversary-in-the-middle cookie capture or device-code phishing. Later activity included Kerberos SPN work, Microsoft Graph and PowerShell directory dumps, and Cmdkey /list after authentication had already succeeded. Those post-auth steps are not undone by any login MFA. Closing the spray-and-push path is what stops this campaign class from minting the first session.
Did CISA say every sprayed account also got push-bombed?
No. Public reporting does not establish that every listed secondary technique appeared on every victim. CISA describes password spraying as a common initial path and push bombing where push-notification MFA was enabled. Organizations reading AA24-290A should treat spray, fatigue, open MFA registration, and weak SSPR as related workforce identity failures, not as one identical kill chain on every tenant.
