Password Spraying Attack: How It Beats Lockout Policies

One password. Tried against ten thousand accounts. No lockout triggered, no alert fired, and one valid credential waiting at the other end.

That is exactly how a password spraying attack works: instead of hammering a single account with many guesses, attackers try one widely-used password across thousands of accounts, deliberately staying under the failed-login threshold at every step. MITRE ATT&CK classifies it as technique T1110.003, and it is one of the most effective ways attackers gain an initial foothold in enterprise environments — no stolen data required.

How Password Spraying Differs from Other Credential Attacks

Three attacks share the same goal — valid credentials — but operate in opposite directions. Confusing them leads organizations to deploy the wrong defenses.

Attack	Passwords tried	Accounts targeted	Needs breach data?	Lockout risk
Brute force	Many (thousands+)	One account	No	High
Credential stuffing	One per account (matched pairs)	Many	Yes	Low
Password spraying	One or two	Many	No	Very low

Brute force is what most lockout policies are built to stop — rapid guessing against a single account. Credential stuffing uses leaked username-password pairs from previous breaches and tries them wholesale. Password spraying needs neither. It relies purely on the statistical certainty that in any organization of meaningful size, at least one user has set a predictable password.

That predictability is structural. When a corporate password policy demands eight characters, an uppercase letter, a digit, and a symbol changed every 90 days, users converge on the same handful of patterns. Attackers exploit exactly that convergence.

Why Lockout Policies Don't Stop It

Most Active Directory environments lock an account after five to ten consecutive failed login attempts. Spraying campaigns try exactly one password per account, then wait — often hours or days — before returning with the next candidate. The failed-attempt counter on most systems resets after a short observation window, commonly 30 minutes, so when the attacker cycles back, each account counter reads zero again.

This architectural gap is why NIST SP 800-63B does not treat account lockout as a primary defense against online guessing. Section 5.1.1.2 instead recommends checking all new passwords against lists of known-compromised credentials — catching weak, predictable choices before they ever become attack surface.

The Passwords Attackers Actually Spray

Spraying campaigns rotate through a short, reliable shortlist. These are not random — they are reverse-engineered from corporate password policy requirements:

• Seasonal patterns: Summer2024!, Winter2023!, Spring2025, Fall2024#
• Organization name variations: Acme2024!, Acme123, AcmeCorp1
• Welcome patterns: Welcome1, Welcome123!, ChangeMe1
• Policy-compliant defaults: Password1!, P@ssword1, Passw0rd!
• Keyboard walks: Qwerty123!, Qwerty1@, Abc12345!

These passwords are not weak because they are short — many meet an 8-character minimum with complexity requirements. They are weak because they are predictable. An organization that forces quarterly resets and complexity rules inadvertently trains its users to append a year and a symbol to a dictionary word and call it done.

The Have I Been Pwned Pwned Passwords database contains over 900 million real-world breached passwords. Many of the patterns above appear in it hundreds of thousands of times. Organizations can query the HIBP API at password-creation time to reject these choices before they ever enter the directory.

Real-World Examples

Midnight Blizzard — Microsoft, 2024. In January 2024, Microsoft disclosed that the Russian state-affiliated threat actor Midnight Blizzard (also tracked as APT29 and Cozy Bear) compromised a legacy non-production test account using a password spray. The account had no MFA protection. From there, the group moved laterally and accessed the email accounts of senior Microsoft executives and security staff, exfiltrating messages over several weeks. The initial entry point was a single unprotected account holding a password that matched a common spray pattern.

CISA advisories on internet-facing portals. CISA has issued multiple advisories attributing significant intrusions to spraying campaigns aimed at internet-exposed authentication endpoints: VPN gateways, Outlook Web Access portals, and single-sign-on login pages. In each case, MFA was absent or disabled on the targeted accounts. The CISA guidance on strong passwords explicitly calls out spraying as a primary motivation for deploying phishing-resistant authentication across all remote-access surfaces.

Both cases share the same failure mode: an account without MFA, holding a password that matched a short-list spray.

Detecting a Spraying Campaign

Traditional brute-force detection looks for many failures against one account. Spraying inverts the pattern entirely — you need to watch for many accounts each showing a small number of failures at roughly the same time from the same source.

Signal	What to look for
Cross-account failure count	Many distinct accounts each with 1–3 failures within a short window
Source IP concentration	A single IP or /24 subnet hitting many different usernames
Request timing	Slow, evenly-spaced attempts rather than rapid bursts
User-agent uniformity	Identical or outdated client strings across many login attempts
Geographic anomaly	Logins from a country or ASN atypical for your organization
Protocol targeting	Disproportionate failures on legacy endpoints (IMAP, SMTP AUTH, OWA)

SIEM rules that fire on "more than N distinct accounts with at least one authentication failure from the same source in T minutes" catch spraying where per-account thresholds miss it entirely. Most enterprise identity platforms — Microsoft Entra ID, Okta, Ping Identity — have built-in spray detection; verify it is enabled and tuned to your environment.

How to Defend Against Password Spraying

1. Enable MFA on every internet-facing service. Multi-factor authentication is the single highest-impact control against spraying. Even a correctly guessed password cannot complete authentication without the second factor. NIST SP 800-63B mandates MFA for any system handling sensitive or personal data. Google's 2-Step Verification documentation provides a clear baseline implementation reference for non-technical stakeholders making the case internally.

2. Move toward phishing-resistant authentication. TOTP authenticator apps — specified in RFC 6238 — are a significant upgrade over passwords alone. But phishing-resistant methods go further: FIDO2 hardware security keys and passkeys as defined by the FIDO Alliance replace the password entirely with a device-bound cryptographic credential. On accounts enrolled with a passkey, a password spraying attack has nothing to target.

3. Block known-compromised passwords at creation time. Integrate the HIBP Pwned Passwords API into your password-reset and account-creation flows. When a user chooses a password that appears in the corpus of real-world breaches, reject it immediately and prompt for a different choice. This directly implements the NIST SP 800-63B section 5.1.1.2 requirement and removes the most commonly sprayed passwords from your user population.

4. Configure cross-account spray detection in your SIEM. A per-account lockout counter is the wrong detection tool. Add alerting that triggers when one source generates authentication failures across many distinct accounts within a defined window — start with a threshold of 10 or more distinct accounts from the same IP within 10 minutes. Tune from there based on your normal authentication baseline.

5. Disable legacy authentication protocols. SMTP AUTH, IMAP/POP3, and Basic Auth against Exchange bypass modern conditional access and MFA policies on most platforms. Attackers target these endpoints precisely because MFA enforcement is routinely absent. Audit what is active, communicate the deprecation timeline to affected users and teams, then block legacy auth at the identity provider level.

6. Apply least privilege to all accounts. Spraying targets accounts indiscriminately. A compromised low-privilege account with no path to sensitive data or lateral movement sharply limits the attacker's blast radius. Review which accounts hold standing admin rights, which service accounts and shared mailboxes exist without MFA, and whether just-in-time access is available as an alternative to permanent elevated roles.

What to Do Right Now

• Enable MFA today on email, VPN, and SSO — these are the first-choice targets for spray campaigns and the fastest wins.
• Audit legacy protocols — check whether SMTP AUTH, IMAP, or Basic Auth is active in your environment and disable what you do not need.
• Run a password check against the HIBP Pwned Passwords corpus; force-reset any accounts whose passwords appear in it.
• Enable cross-account detection in your SIEM or identity provider — per-account lockout alone will not alert you to an active spray campaign.
• Review non-production and service accounts — these are disproportionately targeted because MFA is routinely skipped on them, yet they often hold access to production systems.
• Prioritize passkey rollout for your highest-risk users: executives, IT administrators, finance staff, and anyone with access to sensitive data or infrastructure.