Iranian APT Group Hits Thousands of Organizations With Password Spraying Attacks

The group used AzureHound and Roadtools to conduct reconnaissance in Microsoft Entra ID (formerly Azure Active Directory) environments and deployed multiple persistence mechanisms including the use of Azure Arc.