“Activity observed in this campaign aligned with an Iranian pattern of life, particularly in late May and June, where activity occurred almost exclusively between 9:00 AM and 5:00 PM Iran Standard Time (IRST).”
Iranian state hackers sprayed passwords at thousands of organizations from Tor with a “go-http-client” user agent. They kept office hours in Tehran time. Once inside, they used AzureHound and Roadtools to map Microsoft Entra ID. Microsoft sells the identity platform, then publishes the report on how it got sprayed.