A joint cybersecurity advisory (AA24-290A) issued by CISA, the FBI, the NSA, and allied agencies in Canada and Australia warns that Iranian state-sponsored cyber actors are actively compromising critical infrastructure organizations across healthcare, energy, government, and engineering sectors. The threat actors obtain initial access to Microsoft 365, Azure, and Citrix environments through automated password spraying using tools like DomainPasswordSpray.ps1, frequently bypassing authentication barriers by subjecting personnel to high-frequency multi-factor authentication (MFA) push bombing until rogue login requests are approved.

Once inside, operators establish persistence by abusing open self-service password reset (SSPR) portals on public-facing Active Directory Federation Services (ADFS) or enrolling rogue devices into unconfigured Okta MFA profiles. The actors then conduct extensive living-off-the-land reconnaissance, executing Kerberos SPN enumeration for Kerberoasting, querying domain controllers via PowerShell ADSI LDAP scripts and the Microsoft Graph API, and tunneling lateral RDP traffic via mstsc.exe. Authoring agencies assess these actors operate as initial access brokers, packaging harvested domain architectures and administrative credentials to sell on dark web forums to follow-on ransomware affiliates.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Weak authentication primitives and telephony- or app-based push notifications collapse under automated credential stuffing and fatigue attacks, allowing adversaries to manipulate directory enrollment workflows, register unauthorized MFA tokens, and establish durable directory persistence without triggering malware-based telemetry.
• Bullet 2 — Strategic & Defender Imperative: Critical infrastructure operators must transition immediately to phishing-resistant FIDO2/WebAuthn credentials, enforce number-matching challenges to eliminate push fatigue, restrict public-facing ADFS self-service endpoints, and continuously audit Active Directory for anomalous MFA device registrations and Kerberoasting activity.