More attempts from Russia? They're still trying to get in.

Threat actors operating from Russian infrastructure, specifically through internet service provider PJSC MegaFon, have been conducting a sustained sign-in campaign against Microsoft Exchange Online accounts. The attack pattern is consistent and deliberate, indicating an organised effort rather than opportunistic probing. PJSC MegaFon is one of Russia's largest telecommunications carriers, and its infrastructure has been observed in multiple threat campaigns targeting cloud-based productivity platforms.

The method of attack relies on Legacy SMTP, an older email transmission protocol that predates modern authentication standards. Legacy SMTP is significant because it cannot support multi-factor authentication, meaning that even organisations with strong security policies may remain exposed if legacy protocol access has not been explicitly disabled within their Microsoft 365 environment. Attackers deliberately target this pathway because it bypasses many of the controls that protect modern authentication flows.

The failure reason recorded across these attempts is an incorrect password, which is characteristic of a credential stuffing or password spraying operation. In password spraying, attackers try a small number of commonly used passwords across a large number of accounts, deliberately avoiding account lockout thresholds. This technique is methodical and patient, designed to evade automated detection systems that monitor for repeated failures against a single account.

Organisations using Microsoft Exchange Online should treat Legacy SMTP as a high-risk surface that warrants immediate review. Disabling legacy authentication protocols where they are not operationally required significantly reduces exposure to this class of attack. Security teams should audit authentication logs for SMTP-based sign-in attempts originating from unfamiliar IP ranges and consider implementing conditional access policies that block legacy protocol connections by default.