Password spraying against research labs: an old attack on a new target
The May 5, 2020, CISA and NCSC advisory warned that state-backed groups were spraying passwords at health and research organizations to reach COVID-19 research. The defenses were familiar; applying them across academic medicine’s split identities, data stores and remote access was the hard part.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On May 5, 2020, the US Cybersecurity and Infrastructure Security Agency and the UK National Cyber Security Centre issued a joint advisory. It warned that advanced persistent threat groups were targeting organizations involved in the COVID-19 response. Targets included health care bodies, pharmaceutical companies, academia, medical research organizations and local governments. The advisory said the groups were likely seeking information on national and international health policy and COVID-19 research. It highlighted large-scale password spraying, in which attackers try commonly used passwords against many accounts, and recommended multi-factor authentication, prompt patching of VPNs and other internet-facing services, and user awareness. The following week, the FBI and CISA issued a separate warning about China-linked targeting of COVID-19 research.
Health systems usually plan for criminal attackers who want to encrypt systems or sell patient records. The May 2020 advisory described a different adversary with a different goal: state-backed groups after research and policy information. Password spraying is an old technique, and its defenses are well known. Academic medical centers, research hospitals and life sciences organizations found them hard to apply for structural reasons. The advisory pointed to three exposures, each shaped by how these institutions are organized: credentials spread across several identity systems, research data spread across collaboration tools, and remote access infrastructure stretched by the move home.
Credentials spread across several identity systems
Spraying works because some accounts in any large population use weak or common passwords, and because some services still accept a password alone. Academic medicine multiplies the targets. A physician-researcher may hold a hospital account, a university account and a research computing account, each with its own directory and password policy. Students, visiting scholars and affiliates add thousands more accounts with frequent turnover. Older applications often keep legacy authentication protocols enabled, and those protocols bypass multi-factor prompts.
The defenses follow from that structure. Multi-factor authentication needs to cover every internet-facing entry point in every directory, including the ones set up for convenience. Legacy protocols that cannot support it should be disabled, with exceptions tracked and time-limited. Where directories cannot be merged, a common authentication policy across them removes the weakest link that attackers look for. Accounts of people who have left should be disabled promptly. Nobody notices when a dormant account is compromised.
Detection needs a cross-directory view too. Spraying shows up as many failed sign-ins spread across many accounts from the same sources, each account failing only once or twice. A security team watching one directory at a time may miss the pattern entirely. Sending sign-in logs from all directories to one place, with an alert for that signature, closes the gap.
Users are part of the control. Spraying succeeds against passwords like a season and a year, or the institution’s name with a number. Banning common and organization-specific passwords at the directory level removes most of them without relying on training. Where multi-factor prompts are pushed to phones, users also need to know to reject a prompt they did not start, and how to report it. A reported unexpected prompt is often the first sign that a password has already been guessed.
Research data spread across collaboration tools
COVID research in 2020 moved fast and involved many partners. Data moved through cloud storage, collaboration platforms and email, often outside systems the security team monitored. Unlike patient data, research data is rarely classified or inventoried. It is hard to protect what an institution does not know it holds.
The control starts with classification that covers research assets: unpublished results, assay data, trial designs and sponsor materials. Clear rules should say where each class may be stored and how it may be shared. Principal investigators need approved tools that are easier to use than the alternatives, or they will choose the alternatives. Research agreements with sponsors and government funders often carry their own security terms. A research administration office that records those terms against each project lets the security team know which data carries extra obligations.
Access reviews matter here as well. Research collaborations end, but shared folders and guest accounts often persist. A quarterly review of external sharing on sensitive projects, owned by the project lead, shrinks the exposure without slowing active work.
Remote access infrastructure under load
The advisory also highlighted vulnerable VPN appliances. By May 2020, many health and research organizations had expanded VPN capacity quickly, sometimes by deploying new devices or reviving old ones. Several VPN products had serious vulnerabilities disclosed in 2019 that were still being exploited. Patching an appliance that the whole remote workforce depended on was operationally hard, because downtime hit everyone, clinicians included.
The response is to treat remote access appliances as high-priority assets. That means planned maintenance windows, redundancy that allows patching one device while another carries the load, and monitoring for signs of compromise. Credentials harvested from a vulnerable appliance remain useful to an attacker after the appliance is patched. Patching should therefore be followed by password resets for affected accounts, review of sessions and accounts created while the device was exposed, and a check for unfamiliar administrative changes.
All three exposures cross organizational lines. The hospital, the medical school and the research enterprise often run separate IT teams under separate governance, while attackers move freely between them. A shared inventory of external entry points and sensitive research assets, with one executive accountable for the combined risk, is the precondition for applying any of these defenses consistently. A routine for acting on joint advisories helps too: check the indicators, apply the recommendations, record what was done, within days.
With hindsight
In July 2020, the UK, US and Canadian governments publicly attributed attacks on COVID-19 vaccine research organizations to APT29, a group associated with Russian intelligence. In December 2020, the European Medicines Agency disclosed that documents related to vaccine applications had been unlawfully accessed in a cyberattack. Targeting of research and health policy information continued well beyond the pandemic.
The advisory’s core advice only grew more urgent. The 2024 attack on Change Healthcare, which disrupted claims and pharmacy operations across the United States, was described in congressional testimony as beginning with compromised credentials on a remote access portal that lacked multi-factor authentication. At the end of 2024, HHS proposed HIPAA Security Rule updates that would make multi-factor authentication an explicit requirement for regulated entities, with limited exceptions.