The company had multi-factor authentication on the VPN, and the policy applied to accounts authenticating through the directory. A handful of local accounts on the appliance itself, created for contractors during a project in 2021, sat outside it. One of those accounts had a seasonal password, and a slow spray against a list of likely usernames found it on the second afternoon.
How the spray avoided detection
The attacker tried one password against each username every forty minutes, which never triggered a lockout because no individual account reached its threshold. The appliance logged failures faithfully, and nobody was watching for a pattern across accounts. The NCSC’s guidance for system owners on password administration recommends blocking common and predictable passwords rather than relying on complexity rules, and this incident is why: the password met every complexity requirement in the policy, being a season, a year and an exclamation mark.
What happened after the connection
The account had been provisioned with the same network access as the internal support team, because copying an existing profile was quicker than defining a new one. From the VPN the attacker had a routable position inside the network. Nothing in the network design stopped a remote session from reaching the file server, because the profile had been written for staff who needed exactly that access. They scanned quietly over two days, found a file share holding project documentation and a spreadsheet of system credentials, and began copying data out. The volume was what eventually raised the alarm, when an endpoint agent flagged sustained outbound transfer from a machine that normally sent nothing.
“Every organisation I work with has an account like this somewhere. It is not in the identity system, it was created for a specific reason by somebody who has moved on, and it is exempt from the controls everybody else is subject to. Ask for a list of every account that can authenticate to your perimeter and check each one against your policy. It is a morning’s work and it is the highest value morning you will spend.”
William Fieldhouse, Director, Aardwolf Security Ltd
The response and what it cost
Containment was straightforward once the account was identified: disable it, terminate the sessions, and block the source addresses. Establishing what had been taken was harder, because the file share had no access auditing enabled and the investigation had to infer from network volume rather than from records. That uncertainty drove a broader notification than the evidence strictly required, along with a customer communication exercise that took several weeks. The technical incident lasted four days. The commercial consequences ran for months.
Changes that followed
Local accounts on the appliance were removed entirely, with all authentication moved to the directory so one policy governs everything. Multi-factor authentication coverage is now audited quarterly by listing every authentication path rather than every user. Alerting was added for failed authentications across accounts within a time window, which is what catches a spray. File share auditing was enabled on the shares holding commercial data. External network penetration tests now run twice a year against the perimeter, and an internal network test covers what a foothold reaches, which is the question nobody had asked before this.
Frequently asked questions about password spraying
These questions follow most incidents that begin at a remote access service.
Would account lockout have prevented it?
Not on its own. Spraying is designed around lockout thresholds, trying one password per account per interval. Detection across accounts is what catches it, along with removing the exemption that made a single password sufficient.
How do you find accounts outside your MFA policy?
Enumerate by authentication path rather than by user list. Every appliance, application and service with its own local accounts needs checking, and those local stores are where the exceptions accumulate.
