Proofpoint researchers have identified two active #accounttakeover (#ATO) campaigns, tracked as UNK_PanicPulse & UNK_MistyMirror, targeting #Microsoft365 accounts.
Since March 2024, both clusters have affected 6K+ accounts across 1.4K+ organizations, using botnets & unique client agents.
Our threat analysts have found strong similarities between these threat clusters’ operational infrastructure, tactics, and target selection methods, suggesting that these wide-scale, botnet-driven ATO threats may be tied to a single (currently unattributed) threat actor.
---
Key TTPs:
• Password spraying – Using generic passwords across multiple accounts
• IP rotation – 2.9K IPs linked to 30 abused proxies & ISPs
• Distinct client agents – Leveraging known web crawlers & RSS fetchers
• ‘O365 Suite UX’ abuse – Targeting M365 native sign-in app
---
IOCs (observed user agents):
• AdsBot-Google
• Bloglines/3.1
• FeedFetcher-Google
• Gaisbot/3.0
• msnbot/0.11 & 1.1
• Peach/1.01 (Ubuntu 8.04 LTS)
• facebookexternalhit/1.1
