Chinese threat actor Storm-0940 has been stealing credentials from Microsoft customers by leveraging the Quad7 botnet to launch highly-evasive password spray attacks on a broad cross-section of organizations in Europe and North America. In an October 31 blog post, Microsoft Threat Intelligence said Storm-0940 has been active since at least 2021 and typically obtains access through password spray and brute-force attacks, or by exploiting or misusing network edge applications and services.

Source: SC Magazine