Business in Laos? Unless you're on the ground, it's a threat.

Attackers operating out of Laos, routing activity through infrastructure registered with the Asia Pacific Network Information Centre, have been conducting a targeted sign-in campaign against Microsoft Exchange Online. The method of attack relies on Legacy SMTP authentication — an older email protocol that bypasses many of the modern security controls organisations have in place, including multi-factor authentication. This makes it a preferred vector for threat actors who understand how enterprise email environments are constructed.

The tell-tale sign of this campaign is the volume of account lockouts it produces. When attackers use automated tooling to systematically attempt credentials against an email platform, the repeated failed attempts trigger lockout thresholds — effectively flagging the intrusion through the very security mechanisms designed to stop it. An organisation experiencing an unexpected spike in account lockouts across its Exchange Online environment should treat this as a serious indicator of an active credential attack.

The objective of gaining access to a corporate email platform such as Microsoft Exchange Online extends well beyond reading messages. A successfully compromised email account provides a foothold for business email compromise, internal phishing, data exfiltration, and lateral movement across connected services. The damage from a single breached mailbox can cascade rapidly through an organisation's broader Microsoft 365 environment, particularly where access controls have not been tightly scoped.

Organisations using Microsoft Exchange Online should treat Legacy SMTP as a high-priority exposure and move to disable it where it is not operationally required. Microsoft provides controls within the Exchange admin centre and Azure Active Directory to block legacy authentication protocols at both the tenant and per-user level. Coupling that with conditional access policies, anomalous sign-in alerting, and regular review of authentication logs will significantly reduce the attack surface this campaign is actively exploiting.