Russian infrastructure is probing your email. Time to lock the door.

Attackers operating from Russian infrastructure, specifically through the internet service provider Kom lan Ltd, have been conducting a sustained sign-in campaign against Microsoft Exchange Online. The method of choice is Legacy SMTP authentication — an older email protocol that bypasses many of the modern security controls organisations rely on to protect their accounts, including multi-factor authentication.

The attack pattern involves repeated login attempts that are generating Wrong Password failures, which is a strong indicator of credential stuffing or password spraying activity. In credential stuffing, attackers use large lists of previously leaked usernames and passwords. In password spraying, a small number of common passwords are tried across a wide range of accounts. Both techniques are designed to avoid triggering account lockouts while maximising the chances of a successful breach.

Legacy SMTP is a particular point of concern because many organisations have not disabled it, often leaving it active to support older devices or third-party applications. This creates a persistent and exploitable gap — even where modern authentication has been enforced elsewhere, legacy protocols can provide attackers with an alternative path into the same mailboxes and data.

An organisation that uses Microsoft Exchange Online should treat this as an active threat requiring immediate review. Disabling Legacy SMTP where it is not operationally necessary, auditing authentication logs for anomalous sign-in attempts, and enforcing multi-factor authentication across all supported protocols are the most effective defensive steps available at this time.