APT28 password spray to M365 mailbox: why a password reset does not end it
APT28 sprays Entra ID sign-in, wins one valid account, and settles into quiet mailbox collection. This is state-sponsored collection, not smash-and-grab, so the account can sit silent and the persistence outlives a password reset. Here is how it works, how to spot it, and how to actually evict the actor.
APT28 (Fancy Bear, the GRU-linked actor) is not smashing in for a quick payday. When it runs a password spray against your Microsoft 365 tenant, the goal is collection: get into a mailbox and read mail quietly for as long as possible. That changes the whole response. The compromised account may sit silent, and the persistence the actor leaves behind is built to survive the one thing most teams reach for first, a password reset.
How it works
Password spray is wide and shallow. Instead of hammering one account with many passwords and tripping lockout, the actor tries a few common passwords across hundreds of accounts, paced under the lockout threshold. Most attempts fail with an invalid-credential error, and the whole run hides inside the normal background noise of failed sign-ins that every cloud identity endpoint sees all day. This is T1110 Brute Force, in its spray form, usually sourced from anonymizing infrastructure.
Eventually one account gives. The successful sign-in often comes over a legacy authentication path or a non-interactive flow that does not raise an MFA prompt, so it looks clean. That is T1078 Valid Accounts. The only reason it stands out is that it shares the same source as the failure fan-out that preceded it.
Then the actor settles in. Rather than rely on the interactive credential, they establish footholds that do not depend on the password: an app password added to the account, an inbox forwarding rule pointing at an external address like example.net, and an OAuth consent grant to an attacker-controlled app. That is T1098 Account Manipulation, and using the resulting tokens and app passwords in place of the credential is T1550 Use Alternate Authentication Material. From there the actor reads and stages mail selectively, keeping volume low. That final act is T1114 Email Collection.
Why it matters
The insight that trips teams up is that collection is patient. There is no ransomware note, no mass download, no obvious spike. A single account is compromised and the mailbox is read a little at a time. Because the visible event is one login, the reflex is to treat it as a routine credential compromise: reset the password, tell the user to sign in again, close the ticket.
That does not work here. A password reset does not end a session that is already authenticated. An already-issued refresh token keeps minting access. An app password authenticates without any MFA prompt. A forwarding rule copies mail out silently no matter who owns the password. An OAuth grant reads the mailbox on its own. Every one of those channels outlives the password change, so the collector keeps reading mail while the ticket sits closed.
How to detect it
Do not chase single failed sign-ins. The signal is the pattern plus the pivot. In Entra sign-in logs, look for a distributed, rate-limited fan-out of failures across many accounts with only a few passwords each and no lockouts, then correlate it to a single success from that same infrastructure, especially one that arrived over a legacy or non-interactive path that skipped MFA. Identity Protection risk detections help, but the decisive tell is the spray fan-out tied to the one success. After that, watch for the persistence going in: an app password added, an external inbox forwarding rule created, an OAuth consent granted, and mailbox access recorded in Exchange Online mailbox audit (MailItemsAccessed), including access by a non-interactive token.
How to contain and shut it down
Treat the account as compromised for persistence, not just for its password. In order:
- Disable or reset the account, then revoke all active sessions and refresh tokens (sign-out-everywhere) so an already-issued token cannot keep minting access.
- Remove the persistence: strip attacker-added app passwords, delete external inbox forwarding rules, and revoke OAuth consent grants on the mailbox and tenant.
- Hunt the mailbox audit for access that continued after the reset. If MailItemsAccessed shows non-interactive or app-password access after your reset time, you missed a channel.
For durable eradication, close the paths that let this run: block legacy authentication tenant-wide, enforce phishing-resistant MFA via Conditional Access, disable per-user app passwords, restrict external auto-forwarding, gate OAuth consent, and alert on the spray-pattern sign-in risk. And frame impact around what the mailbox exposed. A quiet nation-state collector who read mail for hours or longer is a data-exposure event even though only one account was touched. Scope the accessed mail from mailbox audit and map notification obligations to the data type and jurisdiction, not to the single login.
Practice it
We built this exact incident in GraphLattice Range: the spray fan-out, the single MFA-skipping success, and the app-password, forwarding-rule, and OAuth persistence that survives a password reset. Teams learn to spot the pattern in the logs and run the containment that actually evicts a token-based collector.