Real-World Cyber Attack Analysis: Unveiling a Targeted Assault on a Nonprofit Executive by 609 IPs Worldwide
In a recent case, I collaborated with a non-profit organization to unravel a classic password spray attack scenario. The organization's Executive Director faced a staggering 1,159 unauthorized sign-in attempts within a few hours.
While Microsoft's defences successfully thwarted 80.9% of the assaults, the remaining attempts revealed concerning patterns about the sophistication and global reach of modern identity attacks against small organizations.
Key Findings
- 1,159 unauthorized sign-in attempts in a concentrated timeframe
- 609 unique IP addresses from around the world
- 80.9% blocked by Microsoft's automated defenses
- Password spray pattern — distributed low-and-slow attempts to avoid lockout thresholds
Why Nonprofits Are Targets
This attack demonstrates that nonprofits are not too small to be targeted. Threat actors use automated tooling that scans for vulnerable accounts at scale — the Executive Director's account was targeted precisely because it would have high-privilege access to organizational data, donor information, and financial systems.
Lessons Learned
- MFA is essential — Even with 80.9% block rate, the remaining attempts could succeed if passwords are weak
- Conditional Access policies — Block sign-ins from impossible travel scenarios and known-bad IP ranges
- Monitor sign-in logs — Regular review of Azure AD sign-in logs catches attacks that automated systems miss
- Password hygiene — Long, unique passwords combined with MFA create defense-in-depth
Content originally published as a 5-page LinkedIn carousel by Ross Moravec. The original post is on LinkedIn.
Written by Ross Moravec, founder of Nonprofit Tech Support.