Iranian threat actors have recently targeted several Office 365 users in a password-spraying campaign. The threat group, noted as DEV-0343, targeted roughly 250 entities thus far and have compromised less than twenty (20) accounts. This ongoing campaign utilizes the tactic of “password spraying”, a type of brute-force attack in which actors will attempt to breach an account based on a list of usernames and a singular password (usually the default system password). Reportedly, these attacks are primarily focused on companies involved with USA/Israeli defense technology, Persian Gulf ports, and global maritime transportation with entities in the Middle East. Tactics, techniques, and procedures (TTPs) for this campaign include connections to accounts from hundreds of active TOR nodes (IP addresses), an altered clone of the Firefox user agent, and the attacks occur based on Iran time zones. The attacks occur between Sunday and Thursday as well as between 7:30am and 8:30pm. Furthermore, DEV-0343 actors have been seen utilizing Autodiscover and ActiveSync, two features built-in to Exchange servers. CTAPT is monitoring this campaign and will provide updates if deemed necessary.