Password Spraying
A password attack technique that uses a small set of common weak passwords to attempt logins against a large number of accounts in order to avoid triggering account lockout policies. It is a variant of credential stuffing.
Timeline (last 90 days)
Password spraying does not require breached data; it sweeps a large number of accounts with only a small set of common passwords, relying on users choosing weak passwords.
Cloud host IPs, Tor exit nodes and open proxies are often used by attackers for password spraying because they can be obtained in bulk and are easy to replace.
Defending against password spraying requires upgrading account lockout policies into a behavior-analysis-driven detection system, while using MFA and password hygiene policies as a fallback.
Password spraying's low-frequency, wide-net strategy can bypass the per-account lockout mechanisms that most enterprises rely on.
The identifiable traces that password spraying leaves at the global level include: abnormal lateral distribution (a large number of different accounts each with a few login failures in a short time), concentrated source IPs (a small number of IPs or IP ranges, especially cloud hosts or proxy nodes), regular time patterns, and abrupt behavioral changes after success.
Password spraying refers to trying a small number of high-frequency weak passwords against a large number of accounts to circumvent the 'lockout after multiple failures' policy.
Effective password protection measures include enabling MFA, regularly rotating passwords, enforcing strong password policies, and employee security awareness training.
All Facts (7)
Password spraying does not require breached data; it sweeps a large number of accounts with only a small set of common passwords, relying on users choosing weak passwords.
50%UnverifiedCloud host IPs, Tor exit nodes and open proxies are often used by attackers for password spraying because they can be obtained in bulk and are easy to replace.
50%UnverifiedDefending against password spraying requires upgrading account lockout policies into a behavior-analysis-driven detection system, while using MFA and password hygiene policies as a fallback.
50%UnverifiedPassword spraying's low-frequency, wide-net strategy can bypass the per-account lockout mechanisms that most enterprises rely on.
50%UnverifiedThe identifiable traces that password spraying leaves at the global level include: abnormal lateral distribution (a large number of different accounts each with a few login failures in a short time), concentrated source IPs (a small number of IPs or IP ranges, especially cloud hosts or proxy nodes), regular time patterns, and abrupt behavioral changes after success.
50%UnverifiedPassword spraying refers to trying a small number of high-frequency weak passwords against a large number of accounts to circumvent the 'lockout after multiple failures' policy.
50%UnverifiedEffective password protection measures include enabling MFA, regularly rotating passwords, enforcing strong password policies, and employee security awareness training.
50%